Executive brief
A vulnerability exists in GStreamer, a widely used multimedia framework for handling audio and video content. By tricking a user into opening a specially crafted RealMedia file, an attacker can cause the media player to crash or hang indefinitely, leading to a denial of service. In some cases, this flaw could also allow the unauthorized reading of small amounts of memory, potentially exposing sensitive information.
Technical details
An out-of-bounds read and infinite loop vulnerability exists in the GStreamer RealMedia demuxer (gst-plugins-ugly) within the gst_rmdemux_parse_mdpr() function. The issue stems from the FILEINFO metadata parser using re_skip_pascal_string() to advance offsets without performing bounds checking against the mapped buffer. Furthermore, the 'element_nb' loop controller is an attacker-controlled signed integer; providing a value such as 0xFFFFFFFF can trigger an infinite loop. An attacker can exploit this by providing a malformed RealMedia file, leading to a denial of service (crash or hang) or information disclosure via out-of-bounds memory reads. As of the advisory date, no official patch is available, and upstream developers recommend a rewrite of the rmdemux component.
Affected products
- GStreamer gstreamer1-plugins-ugly-free unspecified
- GStreamer gst-plugins-ugly unspecified
Timeline
- 2026-06-10: disclosed: Reported via PSIRTSUPT-7239 by Tianshuo Han
- 2026-06-15: advisory: NVD and Red Hat published advisory details