Vendor
Gstreamer vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 69 vulnerabilities in Gstreamer: 14 in the last 7 days and 35 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-125712, was published on 10 November 2026. 18 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. 5 technologies have a page of their own.
- Last 7 days
- 14
- Last 90 days
- 35
- Critical, all time
- 4
- Exploited in the wild
- 0
About Gstreamer
An open-source multimedia framework for creating streaming media applications.
Gstreamer technologies
Latest Gstreamer vulnerabilities
- CVE-2026-125712: GStreamer gst-plugins-base RTCP SDES packet parser buffer over-readhighCVSS 8.2
- CVE-2026-125707: GStreamer MXF demuxer off-by-one buffer writemediumCVSS 6.1
- CVE-2026-125706: GStreamer gst-plugins-bad out-of-bounds read in MPEG/DVD parsingmediumCVSS 5.5
- CVE-2026-125704: GStreamer core buffer value deserialization use-after-freehighCVSS 7.5
- CVE-2026-125703: GStreamer gst-plugins-bad MXF plugin buffer overflow in VANC handlingmediumCVSS 5.5
- CVE-2026-125041: GStreamer gst-plugins-good out-of-bounds heap read in qtdemuxmediumCVSS 5.5
- CVE-2026-125040: GStreamer gst-plugins-base quadratic regex in SRT/WebVTT parsermediumCVSS 6.5
- CVE-2026-121611: GStreamer gst-plugins-bad H.265 uninitialized memory usemediumCVSS 6.5
- CVE-2026-121601: GStreamer MXF demuxer out-of-bounds readmediumCVSS 6.1
- CVE-2026-119610: GStreamer gst-plugins-good H.264 RTP depayloader heap read overflowhighCVSS 8.2
- CVE-2026-121629: GStreamer adaptive streaming demuxers local file disclosure via unvalidated URIshighCVSS 7.5
- CVE-2026-73473: GStreamer gst-plugins-good avidemux denial of servicemediumCVSS 5.5
- CVE-2026-73472: GStreamer gst-plugins-good integer overflow in AVI parsermediumCVSS 6.1
- CVE-2026-73471: GStreamer gst-plugins-good out-of-bounds read in Nikon metadata parsermediumCVSS 6.1
- CVE-2026-121259: GStreamer gst-plugins-bad JPEG 2000 decimator integer overflow and division by zeromediumCVSS 6.5
- CVE-2026-119843: GStreamer gst-plugins-good FLV demuxer buffer validation DoSmediumCVSS 6.5
- CVE-2026-119842: GStreamer gst-plugins-base NULL pointer dereference in MicroDVD parsermediumCVSS 6.5
- CVE-2026-119729: GStreamer integer overflow in AV1 LEB128 parsermediumCVSS 6.5
- CVE-2026-119728: GStreamer gst-plugins-bad NULL pointer dereference in H.264 MVC parsermediumCVSS 5.5
- CVE-2026-119727: GStreamer gst-plugins-bad H.265 parser buffer overflowmediumCVSS 6.5
- CVE-2026-119777: GStreamer gst-plugins-bad H.266/VVC parser integer overflowhighCVSS 7.8
- CVE-2026-116612: GStreamer Editing Services unsafe GES project parsinghighCVSS 7.8
- CVE-2026-111183: GStreamer rtpL16depay heap-based buffer overflowcriticalCVSS 9.8
- CVE-2026-112214: GStreamer gst-plugins-ugly ASF demuxer unbounded memory allocationmediumCVSS 6.5
- CVE-2026-46472: GStreamer gst-plugins-good out-of-bounds read in qtdemux_parse_chnlinfo
Most severe Gstreamer vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-111183: GStreamer rtpL16depay heap-based buffer overflowcriticalCVSS 9.8
- CVE-2016-9636: GStreamer heap buffer overflow in FLIC decodercriticalCVSS 9.8
- CVE-2016-9635: GStreamer heap buffer overflow in FLIC decodercriticalCVSS 9.8
- CVE-2016-9634: GStreamer heap buffer overflow in FLIC decodercriticalCVSS 9.8
- CVE-2026-3083: GStreamer rtpqdm2depay out-of-bounds write in X-QDM RTP parsinghighCVSS 8.8EPSS 0.8%
- CVE-2026-3085: GStreamer heap overflow in rtpqdm2depay elementhighCVSS 8.8EPSS 0.5%
- CVE-2026-52720: GStreamer librfb heap buffer overflow in VNC rectangle decodinghighCVSS 8.8
- CVE-2026-86476: GStreamer gst-plugins-base heap buffer overflow in GstVideoMetahighCVSS 8.4EPSS 0.2%
- CVE-2026-125712: GStreamer gst-plugins-base RTCP SDES packet parser buffer over-readhighCVSS 8.2
- CVE-2026-119610: GStreamer gst-plugins-good H.264 RTP depayloader heap read overflowhighCVSS 8.2
Vulnerabilities per week
18 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 5 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 1 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 5 | 0 | |
| 19 Oct 2026 | 2 | 1 | |
| 26 Oct 2026 | 6 | 0 | |
| 2 Nov 2026 | 5 | 0 | |
| 9 Nov 2026 | 11 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Gstreamer vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/gstreamer)<a href="https://junglewise.ai/threats/vendors/gstreamer"><img src="https://junglewise.ai/threats/vendors/gstreamer/badge.svg" alt="Gstreamer vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/gstreamer.json, and this page as text at https://junglewise.ai/threats/vendors/gstreamer.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Gstreamer vulnerabilities", https://junglewise.ai/threats/vendors/gstreamer, 11 November 2026.