# GStreamer vulnerabilities Source: https://junglewise.ai/threats/technologies/gstreamer Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 11 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/gstreamer.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 33 vulnerabilities in GStreamer: 2 in the last 7 days and 9 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-125707, was published on 10 November 2026. 2 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. ## Counts - Last 7 days: 2 - Last 30 days: 4 - Last 90 days: 9 - All time: 33 (4 critical, 0 exploited in the wild) ## About GStreamer Multimedia framework for building audio and video applications. ## Latest GStreamer vulnerabilities - [CVE-2026-125707: GStreamer MXF demuxer off-by-one buffer write](https://junglewise.ai/threats/cve-2026-125707-a-flaw-was-found-in-gstreamer-s-mxf-demuxer-when-an-application) (medium, CVSS 6.1, published 10 Nov 2026) - [CVE-2026-125704: GStreamer core buffer value deserialization use-after-free](https://junglewise.ai/threats/cve-2026-125704-a-use-after-free-flaw-was-found-in-gstreamer-core-buffer-value) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-119729: GStreamer integer overflow in AV1 LEB128 parser](https://junglewise.ai/threats/cve-2026-119729-a-flaw-was-found-in-gstreamer-an-integer-overflow-vulnerability) (medium, CVSS 6.5, published 30 Oct 2026) - [CVE-2026-111183: GStreamer rtpL16depay heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-111183-gstreamer-rtpl16depay-heap-based-buffer-overflow-remote-code) (critical, CVSS 9.8, published 21 Oct 2026) - [CVE-2026-18299: GStreamer rtpsbcdepay use-after-free in RTP SBC payload parsing](https://junglewise.ai/threats/cve-2026-18299-gstreamer-rtpsbcdepay-use-after-free-in-rtp-sbc-payload-parsing) (high, CVSS 7.8, published 20 Aug 2026) - [CVE-2026-18298: GStreamer gst-plugins-good heap buffer overflow in GdkPixbuf decoder](https://junglewise.ai/threats/cve-2026-18298-gstreamer-gst-plugins-good-heap-buffer-overflow-in-gdkpixbuf) (high, CVSS 7.8, published 20 Aug 2026) - [CVE-2026-18297: GStreamer Opus decoder stack-based buffer overflow](https://junglewise.ai/threats/cve-2026-18297-gstreamer-opus-decoder-stack-based-buffer-overflow) (high, CVSS 7.8, published 20 Aug 2026) - [CVE-2026-18296: GStreamer MRF file parsing heap buffer overflow](https://junglewise.ai/threats/cve-2026-18296-gstreamer-mrf-file-parsing-heap-buffer-overflow) (high, CVSS 7.8, published 20 Aug 2026) - [CVE-2026-18295: GStreamer MRF File Parsing Out-Of-Bounds Write](https://junglewise.ai/threats/cve-2026-18295-gstreamer-mrf-file-parsing-out-of-bounds-write) (high, CVSS 7.8, published 20 Aug 2026) - [CVE-2026-12892: GStreamer gst-plugins-bad heap out-of-bounds read in H.264 parser](https://junglewise.ai/threats/cve-2026-12892-gstreamer-gst-plugins-bad-heap-out-of-bounds-read-in-h-264-parser) (medium, CVSS 4.4, published 23 Jun 2026) - [CVE-2026-52721: GStreamer out-of-bounds read in pcapparse element](https://junglewise.ai/threats/cve-2026-52721-gstreamer-out-of-bounds-read-in-pcapparse-element) (medium, CVSS 5.3, published 15 Jun 2026) - [CVE-2026-1940: An incomplete fix for allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation c](https://junglewise.ai/threats/cve-2026-1940-an-incomplete-fix-for-allows-an-out-of-bounds-read-in-gst-wavparse) (medium, CVSS 5.1, published 23 Mar 2026) - [CVE-2026-3086: GStreamer H.266 Codec Parser out-of-bounds write in APS units](https://junglewise.ai/threats/cve-2026-3086-gstreamer-h-266-codec-parser-out-of-bounds-write-in-aps-units) (high, CVSS 7.8, published 16 Mar 2026) - [CVE-2026-3085: GStreamer heap overflow in rtpqdm2depay element](https://junglewise.ai/threats/cve-2026-3085-gstreamer-heap-overflow-in-rtpqdm2depay-element) (high, CVSS 8.8, published 16 Mar 2026) - [CVE-2026-3084: GStreamer H.266 Codec Parser integer underflow in picture partitions](https://junglewise.ai/threats/cve-2026-3084-gstreamer-h-266-codec-parser-integer-underflow-in-picture) (high, CVSS 7.8, published 16 Mar 2026) - [CVE-2026-3083: GStreamer rtpqdm2depay out-of-bounds write in X-QDM RTP parsing](https://junglewise.ai/threats/cve-2026-3083-gstreamer-rtpqdm2depay-out-of-bounds-write-in-x-qdm-rtp-parsing) (high, CVSS 8.8, published 16 Mar 2026) - [CVE-2026-3082: GStreamer JPEG Parser heap overflow in Huffman table processing](https://junglewise.ai/threats/cve-2026-3082-gstreamer-jpeg-parser-heap-overflow-in-huffman-table-processing) (high, CVSS 7.8, published 16 Mar 2026) - [CVE-2026-3081: GStreamer H.266 codec parser stack-based buffer overflow](https://junglewise.ai/threats/cve-2026-3081-gstreamer-h-266-codec-parser-stack-based-buffer-overflow) (high, CVSS 7.8, published 16 Mar 2026) - [CVE-2026-2923: GStreamer out-of-bounds write in DVB Subtitles handling](https://junglewise.ai/threats/cve-2026-2923-gstreamer-out-of-bounds-write-in-dvb-subtitles-handling) (high, CVSS 7.8, published 16 Mar 2026) - [CVE-2026-2922: GStreamer RealMedia Demuxer out-of-bounds write](https://junglewise.ai/threats/cve-2026-2922-gstreamer-realmedia-demuxer-out-of-bounds-write) (high, CVSS 7.8, published 16 Mar 2026) - [CVE-2026-2921: GStreamer RIFF palette integer overflow in AVI handling](https://junglewise.ai/threats/cve-2026-2921-gstreamer-riff-palette-integer-overflow-in-avi-handling) (high, CVSS 7.8, published 16 Mar 2026) - [CVE-2026-2920: GStreamer heap overflow in ASF demuxer](https://junglewise.ai/threats/cve-2026-2920-gstreamer-heap-overflow-in-asf-demuxer) (high, CVSS 7.8, published 16 Mar 2026) - [CVE-2025-47219: GStreamer isomp4 plugin out-of-bounds read in qtdemux_parse_trak](https://junglewise.ai/threats/cve-2025-47219-gstreamer-isomp4-plugin-out-of-bounds-read-in-qtdemux-parse-trak) (high, CVSS 8.1, published 7 Aug 2025) - [CVE-2016-9636: GStreamer heap buffer overflow in FLIC decoder](https://junglewise.ai/threats/cve-2016-9636-gstreamer-heap-buffer-overflow-in-flic-decoder) (critical, CVSS 9.8, published 27 Jan 2017) - [CVE-2016-9635: GStreamer heap buffer overflow in FLIC decoder](https://junglewise.ai/threats/cve-2016-9635-gstreamer-heap-buffer-overflow-in-flic-decoder) (critical, CVSS 9.8, published 27 Jan 2017) ## Most severe GStreamer vulnerabilities - [CVE-2026-111183: GStreamer rtpL16depay heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-111183-gstreamer-rtpl16depay-heap-based-buffer-overflow-remote-code) (critical, CVSS 9.8, published 21 Oct 2026) - [CVE-2016-9636: GStreamer heap buffer overflow in FLIC decoder](https://junglewise.ai/threats/cve-2016-9636-gstreamer-heap-buffer-overflow-in-flic-decoder) (critical, CVSS 9.8, published 27 Jan 2017) - [CVE-2016-9635: GStreamer heap buffer overflow in FLIC decoder](https://junglewise.ai/threats/cve-2016-9635-gstreamer-heap-buffer-overflow-in-flic-decoder) (critical, CVSS 9.8, published 27 Jan 2017) - [CVE-2016-9634: GStreamer heap buffer overflow in FLIC decoder](https://junglewise.ai/threats/cve-2016-9634-gstreamer-heap-buffer-overflow-in-flic-decoder) (critical, CVSS 9.8, published 27 Jan 2017) - [CVE-2026-3083: GStreamer rtpqdm2depay out-of-bounds write in X-QDM RTP parsing](https://junglewise.ai/threats/cve-2026-3083-gstreamer-rtpqdm2depay-out-of-bounds-write-in-x-qdm-rtp-parsing) (high, CVSS 8.8, published 16 Mar 2026) - [CVE-2026-3085: GStreamer heap overflow in rtpqdm2depay element](https://junglewise.ai/threats/cve-2026-3085-gstreamer-heap-overflow-in-rtpqdm2depay-element) (high, CVSS 8.8, published 16 Mar 2026) - [CVE-2025-47219: GStreamer isomp4 plugin out-of-bounds read in qtdemux_parse_trak](https://junglewise.ai/threats/cve-2025-47219-gstreamer-isomp4-plugin-out-of-bounds-read-in-qtdemux-parse-trak) (high, CVSS 8.1, published 7 Aug 2025) - [CVE-2026-2921: GStreamer RIFF palette integer overflow in AVI handling](https://junglewise.ai/threats/cve-2026-2921-gstreamer-riff-palette-integer-overflow-in-avi-handling) (high, CVSS 7.8, published 16 Mar 2026) - [CVE-2026-2920: GStreamer heap overflow in ASF demuxer](https://junglewise.ai/threats/cve-2026-2920-gstreamer-heap-overflow-in-asf-demuxer) (high, CVSS 7.8, published 16 Mar 2026) - [CVE-2026-2923: GStreamer out-of-bounds write in DVB Subtitles handling](https://junglewise.ai/threats/cve-2026-2923-gstreamer-out-of-bounds-write-in-dvb-subtitles-handling) (high, CVSS 7.8, published 16 Mar 2026) ## Vulnerabilities per week 2 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 5 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 1 | 1 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 2 | 0 | 0 | ## Other Gstreamer technologies - [Gstreamer Gst-Plugins-Bad](https://junglewise.ai/threats/technologies/gst-plugins-bad): 19 vulnerabilities - [Gstreamer Gst-Plugins-Good](https://junglewise.ai/threats/technologies/gstreamer-gst-plugins-good): 9 vulnerabilities - [Gstreamer Gst-Plugins-Ugly](https://junglewise.ai/threats/technologies/gst-plugins-ugly): 4 vulnerabilities - [Gstreamer Gst-Plugins-Base](https://junglewise.ai/threats/technologies/gstreamer-gst-plugins-base): 4 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "GStreamer vulnerabilities", https://junglewise.ai/threats/technologies/gstreamer, 11 November 2026.