# CVE-2026-3086: GStreamer H.266 Codec Parser out-of-bounds write in APS units

Source: https://junglewise.ai/threats/cve-2026-3086-gstreamer-h-266-codec-parser-out-of-bounds-write-in-aps-units  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-16. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-3086 · Severity: high · CVSS 7.8 · Published 2026-03-16

GStreamer is a widely used multimedia framework for handling audio and video playback. A vulnerability in its H.266 video processing component could allow an attacker to execute malicious code if a user opens a specially crafted video file. This could lead to a full system compromise or unauthorized access to sensitive data on the affected machine.

Technologies: [Gstreamer Gst-Plugins-Bad](https://junglewise.ai/threats/technologies/gst-plugins-bad), [Gstreamer](https://junglewise.ai/threats/technologies/gstreamer), [Red Hat Enterprise Linux 6](https://junglewise.ai/threats/technologies/enterprise-linux-6), [Red Hat Enterprise Linux 8](https://junglewise.ai/threats/technologies/enterprise-linux-8). Vendors: [Gstreamer](https://junglewise.ai/threats/vendors/gstreamer), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-3086 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-3086 being exploited in the wild.

**How severe is CVE-2026-3086?** High severity, with a CVSS score of 7.8, published 16 March 2026.

**Which products and versions are affected?** Gstreamer Gst-Plugins-Bad < 1.28.1; Red Hat Enterprise Linux 6 affected; Red Hat Enterprise Linux 8 affected.

**Is there a fix for CVE-2026-3086?** A patch was published on 2026-02-25: Fix committed to GStreamer repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-3086 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-3086?** Check whether you run Gstreamer Gst-Plugins-Bad, Gstreamer, Red Hat Enterprise Linux 6 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds write vulnerability (CWE-787) exists in the GStreamer H.266 video bitstream parser within the 'gst-plugins-bad' package. The flaw is located in the processing of Adaptation Parameter Set (APS) units, where a lack of proper validation of user-supplied data allows a write past the end of an allocated buffer. While categorized as local/user-interaction required, the vulnerability can be triggered by any application utilizing the GStreamer library to parse malicious H.266 video streams. Successful exploitation can lead to arbitrary code execution in the context of the current process. The issue is addressed in GStreamer version 1.28.1.

## Affected products

- GStreamer GStreamer gst-plugins-bad < 1.28.1
- Red Hat Enterprise Linux 6 affected
- Red Hat Enterprise Linux 8 affected

## Timeline

- 2026-02-11: disclosed: Vulnerability reported to vendor
- 2026-02-25: patched: Fix committed to GStreamer repository
- 2026-03-06: advisory: Coordinated public release of ZDI advisory
- 2026-03-16: advisory: NVD publication date

## References

- [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/025d59cf3459c2903f0384b6b94bc3235e177b53](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/025d59cf3459c2903f0384b6b94bc3235e177b53)
- [https://www.zerodayinitiative.com/advisories/ZDI-26-170/](https://www.zerodayinitiative.com/advisories/ZDI-26-170/)
- [https://access.redhat.com/security/cve/CVE-2026-3086](https://access.redhat.com/security/cve/CVE-2026-3086)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2447493](https://bugzilla.redhat.com/show_bug.cgi?id=2447493)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3086.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3086.json)

## Related threats

- [GStreamer MXF demuxer off-by-one buffer write](https://junglewise.ai/threats/cve-2026-125707-a-flaw-was-found-in-gstreamer-s-mxf-demuxer-when-an-application)
- [GStreamer gst-plugins-bad out-of-bounds read in MPEG/DVD parsing](https://junglewise.ai/threats/cve-2026-125706-a-flaw-was-found-in-gstreamer-s-gst-plugins-bad-mpeg-program)
- [GStreamer core buffer value deserialization use-after-free](https://junglewise.ai/threats/cve-2026-125704-a-use-after-free-flaw-was-found-in-gstreamer-core-buffer-value)
- [GStreamer gst-plugins-bad MXF plugin buffer overflow in VANC handling](https://junglewise.ai/threats/cve-2026-125703-a-flaw-was-found-in-the-gstreamer-gst-plugins-bad-mxf-plugin)
- [GStreamer gst-plugins-bad H.265 uninitialized memory use](https://junglewise.ai/threats/cve-2026-121611-a-flaw-was-found-in-gstreamer-s-gst-plugins-bad-package-a-use-of)