Is CVE-2026-14935 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14935 being exploited in the wild.

How severe is CVE-2026-14935?

Low severity, with a CVSS score of 3.7, published 7 July 2026.

Which products and versions are affected?

Gstreamer Gst-Plugins-Bad 1.28.3, 1.28.4; Red Hat Gstreamer1-Plugins-Bad-Free 1.28.3, 1.28.4.

Is there a fix for CVE-2026-14935?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-14935 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-14935?

Check whether you run Gstreamer Gst-Plugins-Bad or Red Hat Gstreamer1-Plugins-Bad-Free at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14935: GStreamer webrtcbin logic error in SDP fingerprint validation

CVE-2026-14935 · Severity: low · CVSS 3.7 · Published 2026-07-07

A logic error exists in GStreamer, a popular multimedia framework used for handling audio and video streams. The software incorrectly validates security certificates during the setup of WebRTC connections, which are commonly used for real-time video conferencing and communication. If an attacker can intercept the initial connection setup, they could potentially bypass security checks intended to prevent eavesdropping or tampering with the media stream.

Technologies: Gstreamer Gst-Plugins-Bad. Vendors: Gstreamer, Red Hat.

Quick answers

Is CVE-2026-14935 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14935 being exploited in the wild.
How severe is CVE-2026-14935?: Low severity, with a CVSS score of 3.7, published 7 July 2026.
Which products and versions are affected?: Gstreamer Gst-Plugins-Bad 1.28.3, 1.28.4; Red Hat Gstreamer1-Plugins-Bad-Free 1.28.3, 1.28.4.
Is there a fix for CVE-2026-14935?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-14935 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-14935?: Check whether you run Gstreamer Gst-Plugins-Bad or Red Hat Gstreamer1-Plugins-Bad-Free at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A logic vulnerability exists in GStreamer's webrtcbin component (within gst-plugins-bad) due to an inverted boolean condition in the _check_sdp_crypto() function in webrtcsdp.c. The code incorrectly rejects Session Description Protocol (SDP) offers that contain the required 'a=fingerprint' attribute while accepting those that lack it. An attacker capable of performing a man-in-the-middle (MITM) attack on the signaling channel can exploit this to bypass DTLS certificate fingerprint binding. While the signaling channel is typically protected by TLS, this flaw represents a defense-in-depth failure that weakens protections against media stream interception. A fix is planned for GStreamer version 1.28.5.

Affected products

Red Hat gstreamer1-plugins-bad-free 1.28.3, 1.28.4
GStreamer GStreamer gst-plugins-bad 1.28.3, 1.28.4

Timeline

2026-07-07: disclosed: Vulnerability reported and CVE assigned
2026-07-07: advisory: Red Hat published security advisory details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.