Is CVE-2026-2920 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-2920 being exploited in the wild.

How severe is CVE-2026-2920?

High severity, with a CVSS score of 7.8, published 16 March 2026.

Which products and versions are affected?

Gstreamer Versions prior to commit 37d79911.

Is there a fix for CVE-2026-2920?

A patch was published on 2026-02-25: Fix committed to GStreamer repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-2920 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-2920?

Check whether you run Gstreamer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-2920: GStreamer heap overflow in ASF demuxer

CVE-2026-2920 · Severity: high · CVSS 7.8 · Published 2026-03-16

GStreamer is a widely used multimedia framework that allows applications to play, record, and edit audio and video. A security vulnerability has been identified in how it handles ASF video files, which could allow an attacker to take control of a user's system if they are tricked into opening a malicious media file. This could lead to the theft of sensitive data or the installation of unauthorized software.

Technologies: Gstreamer. Vendors: Gstreamer.

Quick answers

Is CVE-2026-2920 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-2920 being exploited in the wild.
How severe is CVE-2026-2920?: High severity, with a CVSS score of 7.8, published 16 March 2026.
Which products and versions are affected?: Gstreamer Versions prior to commit 37d79911.
Is there a fix for CVE-2026-2920?: A patch was published on 2026-02-25: Fix committed to GStreamer repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-2920 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-2920?: Check whether you run Gstreamer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow vulnerability exists in the GStreamer ASF demuxer (gst-plugins-ugly) during the processing of stream headers within ASF files. The flaw is caused by a lack of validation for the number of streams and the length of user-supplied data before copying it into a fixed-length heap buffer. An attacker can exploit this by providing a specially crafted ASF file that, when processed by an application using the GStreamer library, triggers an out-of-bounds write. This can lead to arbitrary code execution in the context of the process running GStreamer. A patch has been released that enforces a limit of 32 streams to prevent the overflow.

Affected products

GStreamer GStreamer Versions prior to commit 37d79911
Red Hat Red Hat Enterprise Linux 8, 9, 10

Timeline

2026-02-11: disclosed: Vulnerability reported to vendor
2026-02-25: patched: Fix committed to GStreamer repository
2026-03-06: advisory: Coordinated public release by ZDI
2026-05-19: patched: Red Hat released security updates (RHSA-2026:19024, RHSA-2026:19180)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.