CVE-2026-3084: GStreamer H.266 Codec Parser integer underflow in picture partitions

CVE-2026-3084 · Severity: high · CVSS 7.8 · Published 2026-03-16

GStreamer is a widely used multimedia framework for processing audio and video. A security flaw in its H.266 video codec parser could allow an attacker to execute malicious code on a user's system if they are tricked into opening a specially crafted video file. This could lead to a full system compromise, data theft, or unauthorized access to the user's environment.

Technologies: Gstreamer Gst-Plugins-Bad, Gstreamer, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8. Vendors: Gstreamer, Red Hat.

Quick answers

Is CVE-2026-3084 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-3084 being exploited in the wild.
How severe is CVE-2026-3084?
High severity, with a CVSS score of 7.8, published 16 March 2026.
Which products and versions are affected?
Gstreamer Gst-Plugins-Bad < 1.28.1; Red Hat Enterprise Linux 6 affected; Red Hat Enterprise Linux 8 affected.
Is there a fix for CVE-2026-3084?
A patch was published on 2026-02-25: Fix committed to GStreamer repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-3084 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-3084?
Check whether you run Gstreamer Gst-Plugins-Bad, Gstreamer, Red Hat Enterprise Linux 6 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer underflow vulnerability exists in the GStreamer H.266 video bitstream parser within the 'gst-plugins-bad' package. The flaw is located in the parsing of picture partitions, where a lack of proper validation of user-supplied data leads to an underflow before a memory write operation. While categorized as local/user-interaction required, an attacker can exploit this by providing a malicious H.266 video file to an application using the GStreamer library. Successful exploitation can result in an out-of-bounds write, potentially leading to arbitrary code execution in the context of the process. The issue is addressed in GStreamer version 1.28.1.

Affected products

  • GStreamer GStreamer gst-plugins-bad < 1.28.1
  • Red Hat Enterprise Linux 6 affected
  • Red Hat Enterprise Linux 8 affected

Timeline

  • 2026-02-11: disclosed: Vulnerability reported to vendor
  • 2026-02-25: patched: Fix committed to GStreamer repository
  • 2026-03-06: advisory: Coordinated public release of ZDI advisory
  • 2026-03-16: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.