A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager thumbnailing service that uses GStreamer autoplugging, the pipeline description is parsed and instantiated without restriction on which elements may be used or which properties may be set. A remote attacker who can deliver a crafted project file to a victim's system can trigger reading or writing of arbitrary local files, issue outbound network requests to attacker-controlled servers, or cause the application to crash. Under certain conditions the file-write capability may be leveraged to achieve code execution.
CVE-2026-111183 is a critical heap-based buffer overflow vulnerability in the GStreamer rtpL16depay component. It arises from improper validation of the length of user-supplied RTP payload data before copying it to a heap buffer. This flaw allows remote attackers to execute arbitrary code within the context of the affected process without requiring user interaction or privileges.
GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the processing of RTP payload elements. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29787.
GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of PNG files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29581.
GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of OGG files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29584.
GStreamer MRF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of MRF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29608.
GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of MRF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29510.
A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets (98 and 10 bytes) without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 bytes, the counter underflows to a very large unsigned value, causing subsequent null-terminated string scanning to read far beyond the allocated heap buffer. Date-format normalization may also write beyond the buffer end. Confirmed impacts include heap out-of-bounds read, out-of-bounds write, heap information disclosure (adjacent data appearing in parsed metadata), and application crash/denial of service. The avidemux element is auto-plugged by playbin, decodebin, and gst-discoverer, so opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).
A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's qtdemux_audio_caps function does not sufficiently validate atom data before performing division operations, leading to denial of service due to integer division by zero.
CVE-2026-46469 is a medium severity vulnerability in GStreamer's gst-plugins-good before version 1.28.2. The vulnerability exists in the isomp4 plugin's qtdemux_parse_trak function, which does not properly validate MP4 atom data before performing division operations. This can lead to an integer division by zero, causing a denial of service. The issue affects local attackers and does not impact confidentiality or integrity. No official patch or remediation guidance is currently confirmed.
CVE-2024-47834 is a use-after-free vulnerability in the GStreamer media-handling library affecting the processing of CodecPrivate elements in Matroska streams. The flaw occurs when memory allocated for codec private data is freed but later accessed during serialization, leading to a use-after-free read. This vulnerability has been fixed in GStreamer version 1.24.10.
GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been detected in the parse_lrc function within gstsubparse.c. The parse_lrc function calls strchr() to find the character ']' in the string line. The pointer returned by this call is then passed to g_strdup(). However, if the string line does not contain the character ']', strchr() returns NULL, and a call to g_strdup(start + 1) leads to a null pointer dereference. This vulnerability is fixed in 1.24.10.
CVE-2024-47778 is an out-of-bounds read vulnerability in the gst_wavparse_adtl_chunk function of the GStreamer media-handling library. The flaw is due to insufficient validation of a size parameter, allowing reads beyond the data buffer. This can lead to reading up to 4GB of process memory or cause a segmentation fault. The issue is fixed in version 1.24.10.
CVE-2024-47777 is an out-of-bounds read vulnerability in the GStreamer media-handling library. The flaw exists in the gst_wavparse_smpl_chunk function, which reads 4 bytes from an offset without verifying the buffer size, potentially causing it to read beyond the buffer boundary. This issue is fixed in version 1.24.10.
CVE-2024-47776 is an out-of-bounds read vulnerability in the gst_wavparse_cue_chunk function of the GStreamer media-handling library. The flaw arises from a miscalculation of the chunk size, causing a buffer size check to fail and allowing reads beyond the data buffer. This can lead to application crashes or potential leakage of sensitive data. The issue is fixed in GStreamer version 1.24.10.
CVE-2024-47775 is an out-of-bounds read vulnerability in the GStreamer media-handling library, specifically in the parse_ds64 function of gstwavparse.c. The function fails to verify buffer size before reading, which can cause reading beyond buffer limits. This may result in application crashes or potential leakage of sensitive data. The issue is fixed in version 1.24.10.
CVE-2024-47774 is an out-of-bounds read vulnerability in GStreamer's gst_avi_subtitle_parse_gab2_chunk function. The flaw arises from improper validation of the name_length value read from input, leading to an integer overflow and subsequent memory access beyond the buffer. This issue is fixed in version 1.24.10.
A null pointer dereference vulnerability exists in GStreamer's gst_gdk_pixbuf_dec_flush function, which can cause a denial of service via a segmentation fault. This occurs when the function attempts to memcpy to a null frame pointer. The issue is fixed in version 1.24.10.
GStreamer is a library for constructing graphs of media-handling components. An OOB-Write has been detected in the function gst_parse_vorbis_setup_packet within vorbis_parse.c. The integer size is read from the input file without proper validation. As a result, size can exceed the fixed size of the pad->vorbis_mode_sizes array (which size is 256). When this happens, the for loop overwrites the entire pad structure with 0s and 1s, affecting adjacent memory as well. This OOB-write can overwrite up to 380 bytes of memory beyond the boundaries of the pad->vorbis_mode_sizes array. This vulnerability is fixed in 1.24.10.