# CVE-2026-18296: GStreamer MRF file parsing heap buffer overflow

Source: https://junglewise.ai/threats/cve-2026-18296-gstreamer-mrf-file-parsing-heap-buffer-overflow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-18296 · Severity: high · CVSS 7.8 · Published 2026-08-20

GStreamer is a multimedia framework used to build applications that handle audio and video playback, streaming, and transcoding. The qtmoovrecover utility component contains a heap buffer overflow when parsing recovery files, allowing an attacker to achieve arbitrary code execution if a user opens a crafted malicious file. This could lead to complete system compromise or data theft.

Technologies: [Gstreamer](https://junglewise.ai/threats/technologies/gstreamer). Vendors: [Gstreamer](https://junglewise.ai/threats/vendors/gstreamer).

## Quick answers

**Is CVE-2026-18296 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18296 being exploited in the wild.

**How severe is CVE-2026-18296?** High severity, with a CVSS score of 7.8, published 20 August 2026.

**Which products and versions are affected?** GStreamer gst-plugins-good < 1.28.5.

**Is there a fix for CVE-2026-18296?** A patch was published on 2026-07-08: Fix available in gst-plugins-good 1.28.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-18296 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-18296?** Check whether you run Gstreamer. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a heap buffer overflow in the qtmoovrecover element (MOV/MP4 moov recovery tool) of gst-plugins-good during parsing of MRF (recovery) files. The root cause is insufficient validation of atom size fields in the file parser, combined with size calculations that can truncate larger values, resulting in undersized heap buffer allocations. When parsing a crafted MRF file with malformed atom declarations, subsequent writes overflow the heap buffer boundary. The attack requires user interaction (opening a malicious file), and the component is a utility rather than part of standard playback pipelines, limiting exposure. An attacker can achieve code execution, denial of service, or data corruption. The vulnerability is patched in gst-plugins-good 1.28.5 and later.

## Affected products

- GStreamer gst-plugins-good < 1.28.5

## Timeline

- 2026-05-21: disclosed: Vulnerability reported to vendor
- 2026-07-29: advisory: Public advisory released (ZDI-26-464)
- 2026-07-08: patched: Fix available in gst-plugins-good 1.28.5

## References

- [https://gstreamer.freedesktop.org/security/sa-2026-0050.html](https://gstreamer.freedesktop.org/security/sa-2026-0050.html)
- [https://www.zerodayinitiative.com/advisories/ZDI-26-464/](https://www.zerodayinitiative.com/advisories/ZDI-26-464/)

## Related threats

- [GStreamer MXF demuxer off-by-one buffer write](https://junglewise.ai/threats/cve-2026-125707-a-flaw-was-found-in-gstreamer-s-mxf-demuxer-when-an-application)
- [GStreamer core buffer value deserialization use-after-free](https://junglewise.ai/threats/cve-2026-125704-a-use-after-free-flaw-was-found-in-gstreamer-core-buffer-value)
- [GStreamer integer overflow in AV1 LEB128 parser](https://junglewise.ai/threats/cve-2026-119729-a-flaw-was-found-in-gstreamer-an-integer-overflow-vulnerability)
- [GStreamer rtpL16depay heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-111183-gstreamer-rtpl16depay-heap-based-buffer-overflow-remote-code)
- [GStreamer rtpsbcdepay use-after-free in RTP SBC payload parsing](https://junglewise.ai/threats/cve-2026-18299-gstreamer-rtpsbcdepay-use-after-free-in-rtp-sbc-payload-parsing)