# CVE-2026-2920: GStreamer heap overflow in ASF demuxer

Source: https://junglewise.ai/threats/cve-2026-2920-gstreamer-heap-overflow-in-asf-demuxer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-16. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-2920 · Severity: high · CVSS 7.8 · Published 2026-03-16

GStreamer is a widely used multimedia framework that allows applications to play, record, and edit audio and video. A security vulnerability has been identified in how it handles ASF video files, which could allow an attacker to take control of a user's system if they are tricked into opening a malicious media file. This could lead to the theft of sensitive data or the installation of unauthorized software.

Technologies: [Gstreamer](https://junglewise.ai/threats/technologies/gstreamer). Vendors: [Gstreamer](https://junglewise.ai/threats/vendors/gstreamer).

## Quick answers

**Is CVE-2026-2920 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-2920 being exploited in the wild.

**How severe is CVE-2026-2920?** High severity, with a CVSS score of 7.8, published 16 March 2026.

**Which products and versions are affected?** Gstreamer Versions prior to commit 37d79911.

**Is there a fix for CVE-2026-2920?** A patch was published on 2026-02-25: Fix committed to GStreamer repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-2920 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-2920?** Check whether you run Gstreamer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow vulnerability exists in the GStreamer ASF demuxer (gst-plugins-ugly) during the processing of stream headers within ASF files. The flaw is caused by a lack of validation for the number of streams and the length of user-supplied data before copying it into a fixed-length heap buffer. An attacker can exploit this by providing a specially crafted ASF file that, when processed by an application using the GStreamer library, triggers an out-of-bounds write. This can lead to arbitrary code execution in the context of the process running GStreamer. A patch has been released that enforces a limit of 32 streams to prevent the overflow.

## Affected products

- GStreamer GStreamer Versions prior to commit 37d79911
- Red Hat Red Hat Enterprise Linux 8, 9, 10

## Timeline

- 2026-02-11: disclosed: Vulnerability reported to vendor
- 2026-02-25: patched: Fix committed to GStreamer repository
- 2026-03-06: advisory: Coordinated public release by ZDI
- 2026-05-19: patched: Red Hat released security updates (RHSA-2026:19024, RHSA-2026:19180)

## References

- [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/37d7991168a223d0810fd1f4493ec6a8b6a510d3](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/37d7991168a223d0810fd1f4493ec6a8b6a510d3)
- [https://www.zerodayinitiative.com/advisories/ZDI-26-164/](https://www.zerodayinitiative.com/advisories/ZDI-26-164/)
- [https://access.redhat.com/errata/RHSA-2026:19024](https://access.redhat.com/errata/RHSA-2026:19024)
- [https://access.redhat.com/errata/RHSA-2026:19180](https://access.redhat.com/errata/RHSA-2026:19180)
- [https://access.redhat.com/errata/RHSA-2026:6259](https://access.redhat.com/errata/RHSA-2026:6259)
- [https://access.redhat.com/errata/RHSA-2026:6300](https://access.redhat.com/errata/RHSA-2026:6300)
- [https://access.redhat.com/errata/RHSA-2026:6750](https://access.redhat.com/errata/RHSA-2026:6750)

## Related threats

- [GStreamer MXF demuxer off-by-one buffer write](https://junglewise.ai/threats/cve-2026-125707-a-flaw-was-found-in-gstreamer-s-mxf-demuxer-when-an-application)
- [GStreamer core buffer value deserialization use-after-free](https://junglewise.ai/threats/cve-2026-125704-a-use-after-free-flaw-was-found-in-gstreamer-core-buffer-value)
- [GStreamer integer overflow in AV1 LEB128 parser](https://junglewise.ai/threats/cve-2026-119729-a-flaw-was-found-in-gstreamer-an-integer-overflow-vulnerability)
- [GStreamer rtpL16depay heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-111183-gstreamer-rtpl16depay-heap-based-buffer-overflow-remote-code)
- [GStreamer rtpsbcdepay use-after-free in RTP SBC payload parsing](https://junglewise.ai/threats/cve-2026-18299-gstreamer-rtpsbcdepay-use-after-free-in-rtp-sbc-payload-parsing)