Quick answers
- Is CVE-2026-18298 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-18298 being exploited in the wild.
- How severe is CVE-2026-18298?
- High severity, with a CVSS score of 7.8, published 20 August 2026.
- Which products and versions are affected?
- GStreamer gst-plugins-good < 1.28.5.
- Is there a fix for CVE-2026-18298?
- A patch was published on 2026-08-20: gst-plugins-good 1.28.5 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-18298 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-18298?
- Check whether you run Gstreamer. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A heap buffer overflow exists in the gdkpixbufdec element of gst-plugins-good, which decodes images using the GdkPixbuf library. The vulnerability occurs because the decoder initializes its output buffer pool based on the dimensions of the first decoded frame and never re-evaluates or reconfigures it when subsequent frames have different dimensions or pixel formats. When processing image sequences where later frames are larger than the first frame, the decoder acquires undersized buffers from the stale pool and writes decoded pixel data beyond the buffer boundary. An attacker can trigger this overflow by providing a crafted image sequence with frames of increasing dimensions through network streams, container files, or local files; user interaction is required to trigger the vulnerability (visiting a malicious page or opening a malicious file). The overflow can result in a crash, denial of service, data corruption, or arbitrary code execution in the context of the application. The issue is fixed in gst-plugins-good 1.28.5, which re-evaluates the output buffer pool whenever frame dimensions or pixel formats change, and lowered the element's rank to prevent auto-selection for decoding untrusted images.
Affected products
- GStreamer gst-plugins-good < 1.28.5
Timeline
- 2026-05-21: disclosed: Vulnerability reported to vendor
- 2026-07-29: advisory: ZDI-26-466 advisory published; coordinated public release
- 2026-07-08: advisory: GStreamer Security Advisory 2026-0052 (CVE-2026-18298)
- 2026-08-20: patched: gst-plugins-good 1.28.5 released with fix