# CVE-2026-2922: GStreamer RealMedia Demuxer out-of-bounds write

Source: https://junglewise.ai/threats/cve-2026-2922-gstreamer-realmedia-demuxer-out-of-bounds-write  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-16. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-2922 · Severity: high · CVSS 7.8 · Published 2026-03-16

GStreamer is a widely used multimedia framework that allows applications to process audio and video. A vulnerability in its RealMedia file processing component could allow an attacker to execute malicious code on a user's system if they are tricked into opening a specially crafted video file. This could lead to a full system compromise, data theft, or unauthorized access to the user's environment.

Technologies: [Gstreamer Gst-Plugins-Ugly](https://junglewise.ai/threats/technologies/gst-plugins-ugly), [Gstreamer](https://junglewise.ai/threats/technologies/gstreamer), [Red Hat Enterprise Linux AppStream](https://junglewise.ai/threats/technologies/enterprise-linux-appstream). Vendors: [Gstreamer](https://junglewise.ai/threats/vendors/gstreamer), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-2922 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-2922 being exploited in the wild.

**How severe is CVE-2026-2922?** High severity, with a CVSS score of 7.8, published 16 March 2026.

**Which products and versions are affected?** Gstreamer Gst-Plugins-Ugly < 1.28.1.

**Is there a fix for CVE-2026-2922?** A patch was published on 2026-02-25: GStreamer project fix date Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-2922 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-2922?** Check whether you run Gstreamer Gst-Plugins-Ugly, Gstreamer or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds write vulnerability exists in the GStreamer RealMedia demuxer (part of gst-plugins-ugly) during the processing of video packets. The flaw is caused by a lack of proper validation of user-supplied data, leading to a write past the end of an allocated heap buffer. While categorized as a remote code execution risk, exploitation typically requires a user to open a malicious media file (Local attack vector with Required User Interaction). Successful exploitation allows an attacker to execute arbitrary code within the context of the process using the GStreamer library. The issue is addressed in GStreamer gst-plugins-ugly version 1.28.1.

## Affected products

- GStreamer GStreamer gst-plugins-ugly < 1.28.1
- Red Hat Red Hat Enterprise Linux AppStream (v. 9)
- Red Hat Red Hat Enterprise Linux AppStream (v. 10)

## Timeline

- 2026-02-11: disclosed: Vulnerability reported to vendor
- 2026-02-25: patched: GStreamer project fix date
- 2026-03-06: advisory: Coordinated public release by ZDI
- 2026-03-16: advisory: NVD publication date

## References

- [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/88df8d2cd063b95a076e8041b47f778a4402f363](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/88df8d2cd063b95a076e8041b47f778a4402f363)
- [https://www.zerodayinitiative.com/advisories/ZDI-26-165/](https://www.zerodayinitiative.com/advisories/ZDI-26-165/)
- [https://access.redhat.com/errata/RHSA-2026:19024](https://access.redhat.com/errata/RHSA-2026:19024)
- [https://access.redhat.com/errata/RHSA-2026:19180](https://access.redhat.com/errata/RHSA-2026:19180)
- [https://access.redhat.com/errata/RHSA-2026:6259](https://access.redhat.com/errata/RHSA-2026:6259)
- [https://access.redhat.com/errata/RHSA-2026:6300](https://access.redhat.com/errata/RHSA-2026:6300)
- [https://access.redhat.com/errata/RHSA-2026:8854](https://access.redhat.com/errata/RHSA-2026:8854)

## Related threats

- [GStreamer MXF demuxer off-by-one buffer write](https://junglewise.ai/threats/cve-2026-125707-a-flaw-was-found-in-gstreamer-s-mxf-demuxer-when-an-application)
- [GStreamer core buffer value deserialization use-after-free](https://junglewise.ai/threats/cve-2026-125704-a-use-after-free-flaw-was-found-in-gstreamer-core-buffer-value)
- [GStreamer integer overflow in AV1 LEB128 parser](https://junglewise.ai/threats/cve-2026-119729-a-flaw-was-found-in-gstreamer-an-integer-overflow-vulnerability)
- [GStreamer rtpL16depay heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-111183-gstreamer-rtpl16depay-heap-based-buffer-overflow-remote-code)
- [GStreamer gst-plugins-ugly ASF demuxer unbounded memory allocation](https://junglewise.ai/threats/cve-2026-112214-a-flaw-was-found-in-the-gstreamer-asf-demuxer-in-gst-plugins)