Threats Tagged 'cve-2026-53704'

GStreamer is a streaming media framework, based on graphs of elements which operate on media data. This package contains plug-ins whose license is not fully compatible with LGPL. Security Fix(es): * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header parser (CVE-2026-53703) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A vulnerability (CVE-2026-53704) was found in GStreamer's RealMedia demuxer within the gst-plugins-ugly package. The flaw involves improper validation of offsets and element counts when parsing specially crafted RealMedia FILEINFO metadata, which can lead to out-of-bounds reads and infinite loops. This may cause applications to crash, hang, or potentially read limited adjacent memory. Red Hat has issued security advisories and released updates for affected Red Hat Enterprise Linux 9 and 10 versions to address this issue.

A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a RealMedia file containing a specially crafted FILEINFO metadata section, the demuxer parses variable-name and variable-value pairs using re_skip_pascal_string() without validating that offsets remain within the mapped buffer. Additionally, the element count controlling the parsing loop is read from attacker-controlled data without validation, which can cause an infinite loop. A crafted RealMedia file can cause the application to crash, hang, or potentially read limited adjacent memory contents.

Multiple vulnerabilities have been identified in GStreamer, an open source multimedia framework with a plugin-based architecture supporting various platforms. The advisory from the Bundesamt für Sicherheit in der Informationstechnik references a total of 10 CVEs related to this issue. No specific affected versions or detailed technical descriptions are provided. There is no information about known exploits in the wild or available patches at this time.