Junglewise Threat Intelligence

CVE-2026-2920: GStreamer heap overflow in ASF demuxer

CVE-2026-2920 · Severity: high · CVSS 7.8 · Published 2026-03-16

Technologies: Gstreamer, Red Hat Enterprise Linux. Vendors: Gstreamer, Red Hat.

Executive brief

GStreamer is a widely used multimedia framework that allows applications to play, record, and edit audio and video. A security vulnerability has been identified in how it handles ASF video files, which could allow an attacker to take control of a user's system if they are tricked into opening a malicious media file. This could lead to the theft of sensitive data or the installation of unauthorized software.

Technical details

A heap-based buffer overflow vulnerability exists in the GStreamer ASF demuxer (gst-plugins-ugly) during the processing of stream headers within ASF files. The flaw is caused by a lack of validation for the number of streams and the length of user-supplied data before copying it into a fixed-length heap buffer. An attacker can exploit this by providing a specially crafted ASF file that, when processed by an application using the GStreamer library, triggers an out-of-bounds write. This can lead to arbitrary code execution in the context of the process running GStreamer. A patch has been released that enforces a limit of 32 streams to prevent the overflow.

Affected products

  • GStreamer GStreamer Versions prior to commit 37d79911
  • Red Hat Red Hat Enterprise Linux 8, 9, 10

Timeline

  • 2026-02-11: disclosed: Vulnerability reported to vendor
  • 2026-02-25: patched: Fix committed to GStreamer repository
  • 2026-03-06: advisory: Coordinated public release by ZDI
  • 2026-05-19: patched: Red Hat released security updates (RHSA-2026:19024, RHSA-2026:19180)

References

Related threats