Is CVE-2026-86476 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86476 being exploited in the wild.

How severe is CVE-2026-86476?

High severity, with a CVSS score of 8.4, published 14 October 2026.

Which products and versions are affected?

Gstreamer Gst-Plugins-Base Before 1.28.8.

How is CVE-2026-86476 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-86476?

Check whether you run Gstreamer Gst-Plugins-Base at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86476: GStreamer gst-plugins-base heap buffer overflow in GstVideoMeta

CVE-2026-86476 · Severity: high · CVSS 8.4 · Published 2026-10-14

A video streaming library used in media players and multimedia applications contains a memory corruption flaw that allows an attacker on the same machine to crash the application or potentially execute code. The vulnerability occurs when processing specially crafted video metadata that claims to access memory beyond what was actually allocated. An attacker controlling the video source can trigger this by sending fabricated metadata through an inter-process communication channel.

Technologies: Gstreamer Gst-Plugins-Base. Vendors: Gstreamer.

Quick answers

Is CVE-2026-86476 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86476 being exploited in the wild.
How severe is CVE-2026-86476?: High severity, with a CVSS score of 8.4, published 14 October 2026.
Which products and versions are affected?: Gstreamer Gst-Plugins-Base Before 1.28.8.
Is there a fix for CVE-2026-86476?: Yes: fixed in GStreamer 1.28.8. Until then: Build or deploy GStreamer without the unixfd plugin (meson option -Dgst-plugins-bad:unixfd=disabled), or implement operational policy to avoid connecting receiver pipelines to Unix socket endpoints controlled by untrusted local processes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86476 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-86476?: Check whether you run Gstreamer Gst-Plugins-Base at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: GStreamer 1.28.8

Build or deploy GStreamer without the unixfd plugin (meson option -Dgst-plugins-bad:unixfd=disabled), or implement operational policy to avoid connecting receiver pipelines to Unix socket endpoints controlled by untrusted local processes.

Technical details

A heap buffer overflow exists in libgstvideo's GstVideoMeta deserialization and gst_video_frame_map_id due to missing range checks on declared plane strides and offsets. The metadata is not validated during deserialization or before video frame mapping, allowing an attacker to craft a buffer with fabricated stride values that exceed the actual backing memory allocation. Exploitation requires local access and either the unixfd IPC plugin or in-process supply of attacker-controlled GstVideoMeta; successful exploitation causes heap out-of-bounds read/write leading to denial of service or potential code execution.

Affected products

GStreamer gst-plugins-base Before 1.28.8

Timeline

2026-10-14: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.