Executive brief
A vulnerability exists in the GStreamer RealMedia demuxer, a component used to process and play RealMedia (.rm) video and audio files. By tricking a user into opening a specially crafted malicious media file, an attacker can cause the application to crash or potentially access small amounts of sensitive information from the system's memory. This could lead to service disruptions for users or applications relying on GStreamer for media playback.
Technical details
An out-of-bounds read vulnerability exists in the GStreamer RealMedia demuxer (gst-plugins-ugly) within the gst_rmdemux_parse_mdpr() function. When parsing Media Properties (MDPR) chunks for audio stream header versions 4 and 5, the demuxer reads codec parameters from fixed byte offsets without verifying that the chunk size is sufficient. An attacker can provide a malformed .rm file with a truncated MDPR chunk to trigger a read beyond the buffer boundaries. This results in an application crash (DoS) or limited information disclosure if the out-of-bounds data is incorporated into stream metadata. No official patch is currently available, and upstream developers have suggested a rewrite of the rmdemux component.
Affected products
- GStreamer gst-plugins-ugly unspecified
Timeline
- 2026-06-10: other: Reported via PSIRTSUPT-7239 by Tianshuo Han
- 2026-06-15: advisory: NVD and Red Hat published advisory data