# CVE-2026-2921: GStreamer RIFF palette integer overflow in AVI handling

Source: https://junglewise.ai/threats/cve-2026-2921-gstreamer-riff-palette-integer-overflow-in-avi-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-16. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-2921 · Severity: high · CVSS 7.8 · Published 2026-03-16

GStreamer is a widely used multimedia framework that allows applications to process audio and video data. A vulnerability in how it handles AVI video files could allow an attacker to execute malicious code on a user's system if they are tricked into opening a specially crafted media file. This could lead to a full system compromise, unauthorized data access, or service disruptions depending on the application using the library.

Technologies: [Gstreamer](https://junglewise.ai/threats/technologies/gstreamer). Vendors: [Debian](https://junglewise.ai/threats/vendors/debian), [Gstreamer](https://junglewise.ai/threats/vendors/gstreamer).

## Quick answers

**Is CVE-2026-2921 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-2921 being exploited in the wild.

**How severe is CVE-2026-2921?** High severity, with a CVSS score of 7.8, published 16 March 2026.

**Which products and versions are affected?** Debian Gst-Plugins-Base1.0 1.18.4-2+deb11u5.

**Is there a fix for CVE-2026-2921?** A patch was published on 2026-02-13: Initial patch authored in GStreamer GitLab Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-2921 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-2921?** Check whether you run Debian Gst-Plugins-Base1.0 or Gstreamer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow vulnerability exists in the GStreamer RIFF parser, specifically within the handling of palette data in AVI files. The flaw stems from insufficient validation of user-supplied palette data, which leads to an integer overflow before memory write operations. An attacker can exploit this by providing a malformed AVI file that, when processed by the library, triggers out-of-bounds reads and writes to heap memory. Successful exploitation allows for arbitrary code execution in the context of the process using the GStreamer library. The issue is addressed in GStreamer gst-plugins-base version 1.28.1.

## Affected products

- GStreamer gst-plugins-base < 1.28.1
- Red Hat Enterprise Linux 8, 10, 10.2, 7 ELS
- Debian gst-plugins-base1.0 1.18.4-2+deb11u5

## Timeline

- 2026-02-11: disclosed: Vulnerability reported to vendor
- 2026-02-13: patched: Initial patch authored in GStreamer GitLab
- 2026-02-25: advisory: GStreamer project advisory SA-2026-0004 released
- 2026-03-06: advisory: Coordinated public release by ZDI
- 2026-03-16: advisory: NVD publication date

## References

- [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/e3a99c35266fc92dd6a18ac5fde028d0cda559e6](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/e3a99c35266fc92dd6a18ac5fde028d0cda559e6)
- [https://www.zerodayinitiative.com/advisories/ZDI-26-168/](https://www.zerodayinitiative.com/advisories/ZDI-26-168/)
- [https://lists.debian.org/debian-lts-announce/2026/03/msg00018.html](https://lists.debian.org/debian-lts-announce/2026/03/msg00018.html)
- [https://access.redhat.com/errata/RHSA-2026:19024](https://access.redhat.com/errata/RHSA-2026:19024)
- [https://access.redhat.com/errata/RHSA-2026:19180](https://access.redhat.com/errata/RHSA-2026:19180)
- [https://access.redhat.com/errata/RHSA-2026:6259](https://access.redhat.com/errata/RHSA-2026:6259)
- [https://access.redhat.com/errata/RHSA-2026:6300](https://access.redhat.com/errata/RHSA-2026:6300)

## Related threats

- [GStreamer MXF demuxer off-by-one buffer write](https://junglewise.ai/threats/cve-2026-125707-a-flaw-was-found-in-gstreamer-s-mxf-demuxer-when-an-application)
- [GStreamer core buffer value deserialization use-after-free](https://junglewise.ai/threats/cve-2026-125704-a-use-after-free-flaw-was-found-in-gstreamer-core-buffer-value)
- [GStreamer integer overflow in AV1 LEB128 parser](https://junglewise.ai/threats/cve-2026-119729-a-flaw-was-found-in-gstreamer-an-integer-overflow-vulnerability)
- [GStreamer rtpL16depay heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-111183-gstreamer-rtpl16depay-heap-based-buffer-overflow-remote-code)
- [GStreamer rtpsbcdepay use-after-free in RTP SBC payload parsing](https://junglewise.ai/threats/cve-2026-18299-gstreamer-rtpsbcdepay-use-after-free-in-rtp-sbc-payload-parsing)