# CVE-2026-2923: GStreamer out-of-bounds write in DVB Subtitles handling

Source: https://junglewise.ai/threats/cve-2026-2923-gstreamer-out-of-bounds-write-in-dvb-subtitles-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-16. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-2923 · Severity: high · CVSS 7.8 · Published 2026-03-16

GStreamer is a widely used multimedia framework that allows applications to process audio and video. A vulnerability in how it handles DVB subtitles could allow an attacker to execute malicious code if a user opens a specially crafted media file. This could lead to a full system compromise or unauthorized access to sensitive data on the user's machine.

Technologies: [Gstreamer](https://junglewise.ai/threats/technologies/gstreamer), [Red Hat Enterprise Linux AppStream](https://junglewise.ai/threats/technologies/enterprise-linux-appstream). Vendors: [Gstreamer](https://junglewise.ai/threats/vendors/gstreamer), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-2923 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-2923 being exploited in the wild.

**How severe is CVE-2026-2923?** High severity, with a CVSS score of 7.8, published 16 March 2026.

**Which products and versions are affected?** Gstreamer All versions prior to commit 3b8253f4.

**Is there a fix for CVE-2026-2923?** A patch was published on 2026-02-25: Fix committed to GStreamer repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-2923 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-2923?** Check whether you run Gstreamer or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds write vulnerability exists in GStreamer's dvbsuboverlay component due to insufficient validation of user-supplied coordinate data within DVB subtitle segments. Specifically, the flaw occurs in the _dvb_sub_parse_clut_segment and related parsing functions where missing bounds checks allow data to be written past the end of an allocated buffer. An attacker can exploit this by providing a malicious media file containing crafted DVB subtitle metadata. Successful exploitation requires a user to interact with the library (e.g., by opening the file in a media player using GStreamer) and can result in arbitrary code execution in the context of the current process. A patch has been released in the GStreamer git repository (commit 3b8253f4).

## Affected products

- GStreamer GStreamer All versions prior to commit 3b8253f4
- Red Hat Enterprise Linux AppStream (v. 8)
- Red Hat Enterprise Linux AppStream (v. 9)
- Red Hat Enterprise Linux AppStream (v. 10)

## Timeline

- 2026-02-11: disclosed: Vulnerability reported to vendor
- 2026-02-25: patched: Fix committed to GStreamer repository
- 2026-03-06: advisory: Coordinated public release by Zero Day Initiative
- 2026-03-16: advisory: Published to NVD

## References

- [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/3b8253f447bcc9831dbf643d2c69b205fedbe086](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/3b8253f447bcc9831dbf643d2c69b205fedbe086)
- [https://www.zerodayinitiative.com/advisories/ZDI-26-161/](https://www.zerodayinitiative.com/advisories/ZDI-26-161/)
- [https://access.redhat.com/errata/RHSA-2026:19024](https://access.redhat.com/errata/RHSA-2026:19024)
- [https://access.redhat.com/errata/RHSA-2026:19180](https://access.redhat.com/errata/RHSA-2026:19180)
- [https://access.redhat.com/errata/RHSA-2026:6259](https://access.redhat.com/errata/RHSA-2026:6259)
- [https://access.redhat.com/errata/RHSA-2026:6300](https://access.redhat.com/errata/RHSA-2026:6300)
- [https://access.redhat.com/errata/RHSA-2026:6750](https://access.redhat.com/errata/RHSA-2026:6750)

## Related threats

- [GStreamer MXF demuxer off-by-one buffer write](https://junglewise.ai/threats/cve-2026-125707-a-flaw-was-found-in-gstreamer-s-mxf-demuxer-when-an-application)
- [GStreamer core buffer value deserialization use-after-free](https://junglewise.ai/threats/cve-2026-125704-a-use-after-free-flaw-was-found-in-gstreamer-core-buffer-value)
- [GStreamer integer overflow in AV1 LEB128 parser](https://junglewise.ai/threats/cve-2026-119729-a-flaw-was-found-in-gstreamer-an-integer-overflow-vulnerability)
- [GStreamer rtpL16depay heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-111183-gstreamer-rtpl16depay-heap-based-buffer-overflow-remote-code)
- [GStreamer rtpsbcdepay use-after-free in RTP SBC payload parsing](https://junglewise.ai/threats/cve-2026-18299-gstreamer-rtpsbcdepay-use-after-free-in-rtp-sbc-payload-parsing)