Junglewise Threat Intelligence

CVE-2026-2923: GStreamer out-of-bounds write in DVB Subtitles handling

CVE-2026-2923 · Severity: high · CVSS 7.8 · Published 2026-03-16

Technologies: Red Hat Enterprise Linux AppStream, Gstreamer. Vendors: Red Hat, Gstreamer.

Executive brief

GStreamer is a widely used multimedia framework that allows applications to process audio and video. A vulnerability in how it handles DVB subtitles could allow an attacker to execute malicious code if a user opens a specially crafted media file. This could lead to a full system compromise or unauthorized access to sensitive data on the user's machine.

Technical details

An out-of-bounds write vulnerability exists in GStreamer's dvbsuboverlay component due to insufficient validation of user-supplied coordinate data within DVB subtitle segments. Specifically, the flaw occurs in the _dvb_sub_parse_clut_segment and related parsing functions where missing bounds checks allow data to be written past the end of an allocated buffer. An attacker can exploit this by providing a malicious media file containing crafted DVB subtitle metadata. Successful exploitation requires a user to interact with the library (e.g., by opening the file in a media player using GStreamer) and can result in arbitrary code execution in the context of the current process. A patch has been released in the GStreamer git repository (commit 3b8253f4).

Affected products

  • GStreamer GStreamer All versions prior to commit 3b8253f4
  • Red Hat Enterprise Linux AppStream (v. 8)
  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux AppStream (v. 10)

Timeline

  • 2026-02-11: disclosed: Vulnerability reported to vendor
  • 2026-02-25: patched: Fix committed to GStreamer repository
  • 2026-03-06: advisory: Coordinated public release by Zero Day Initiative
  • 2026-03-16: advisory: Published to NVD

References

Related threats