Is CVE-2026-2921 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-2921 being exploited in the wild.

How severe is CVE-2026-2921?

High severity, with a CVSS score of 7.8, published 16 March 2026.

Which products and versions are affected?

Debian Gst-Plugins-Base1.0 1.18.4-2+deb11u5.

Is there a fix for CVE-2026-2921?

A patch was published on 2026-02-13: Initial patch authored in GStreamer GitLab Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-2921 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-2921?

Check whether you run Debian Gst-Plugins-Base1.0 or Gstreamer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-2921: GStreamer RIFF palette integer overflow in AVI handling

CVE-2026-2921 · Severity: high · CVSS 7.8 · Published 2026-03-16

GStreamer is a widely used multimedia framework that allows applications to process audio and video data. A vulnerability in how it handles AVI video files could allow an attacker to execute malicious code on a user's system if they are tricked into opening a specially crafted media file. This could lead to a full system compromise, unauthorized data access, or service disruptions depending on the application using the library.

Technologies: Gstreamer. Vendors: Debian, Gstreamer.

Quick answers

Is CVE-2026-2921 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-2921 being exploited in the wild.
How severe is CVE-2026-2921?: High severity, with a CVSS score of 7.8, published 16 March 2026.
Which products and versions are affected?: Debian Gst-Plugins-Base1.0 1.18.4-2+deb11u5.
Is there a fix for CVE-2026-2921?: A patch was published on 2026-02-13: Initial patch authored in GStreamer GitLab Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-2921 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-2921?: Check whether you run Debian Gst-Plugins-Base1.0 or Gstreamer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer overflow vulnerability exists in the GStreamer RIFF parser, specifically within the handling of palette data in AVI files. The flaw stems from insufficient validation of user-supplied palette data, which leads to an integer overflow before memory write operations. An attacker can exploit this by providing a malformed AVI file that, when processed by the library, triggers out-of-bounds reads and writes to heap memory. Successful exploitation allows for arbitrary code execution in the context of the process using the GStreamer library. The issue is addressed in GStreamer gst-plugins-base version 1.28.1.

Affected products

GStreamer gst-plugins-base < 1.28.1
Red Hat Enterprise Linux 8, 10, 10.2, 7 ELS
Debian gst-plugins-base1.0 1.18.4-2+deb11u5

Timeline

2026-02-11: disclosed: Vulnerability reported to vendor
2026-02-13: patched: Initial patch authored in GStreamer GitLab
2026-02-25: advisory: GStreamer project advisory SA-2026-0004 released
2026-03-06: advisory: Coordinated public release by ZDI
2026-03-16: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.