Is CVE-2026-2923 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-2923 being exploited in the wild.

How severe is CVE-2026-2923?

High severity, with a CVSS score of 7.8, published 16 March 2026.

Which products and versions are affected?

Gstreamer All versions prior to commit 3b8253f4.

Is there a fix for CVE-2026-2923?

A patch was published on 2026-02-25: Fix committed to GStreamer repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-2923 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-2923?

Check whether you run Gstreamer or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-2923: GStreamer out-of-bounds write in DVB Subtitles handling

CVE-2026-2923 · Severity: high · CVSS 7.8 · Published 2026-03-16

GStreamer is a widely used multimedia framework that allows applications to process audio and video. A vulnerability in how it handles DVB subtitles could allow an attacker to execute malicious code if a user opens a specially crafted media file. This could lead to a full system compromise or unauthorized access to sensitive data on the user's machine.

Technologies: Gstreamer, Red Hat Enterprise Linux AppStream. Vendors: Gstreamer, Red Hat.

Quick answers

Is CVE-2026-2923 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-2923 being exploited in the wild.
How severe is CVE-2026-2923?: High severity, with a CVSS score of 7.8, published 16 March 2026.
Which products and versions are affected?: Gstreamer All versions prior to commit 3b8253f4.
Is there a fix for CVE-2026-2923?: A patch was published on 2026-02-25: Fix committed to GStreamer repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-2923 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-2923?: Check whether you run Gstreamer or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds write vulnerability exists in GStreamer's dvbsuboverlay component due to insufficient validation of user-supplied coordinate data within DVB subtitle segments. Specifically, the flaw occurs in the _dvb_sub_parse_clut_segment and related parsing functions where missing bounds checks allow data to be written past the end of an allocated buffer. An attacker can exploit this by providing a malicious media file containing crafted DVB subtitle metadata. Successful exploitation requires a user to interact with the library (e.g., by opening the file in a media player using GStreamer) and can result in arbitrary code execution in the context of the current process. A patch has been released in the GStreamer git repository (commit 3b8253f4).

Affected products

GStreamer GStreamer All versions prior to commit 3b8253f4
Red Hat Enterprise Linux AppStream (v. 8)
Red Hat Enterprise Linux AppStream (v. 9)
Red Hat Enterprise Linux AppStream (v. 10)

Timeline

2026-02-11: disclosed: Vulnerability reported to vendor
2026-02-25: patched: Fix committed to GStreamer repository
2026-03-06: advisory: Coordinated public release by Zero Day Initiative
2026-03-16: advisory: Published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.