Gstreamer Project vulnerabilities

6 vulnerabilities

Known vulnerabilities in Gstreamer Project products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 5 products.

Products

5
RoutineCVE-2026-119843gstreamer project · gst-plugins-good +2 moreGst-plugins-good: assertion failures in FLV demuxer when parsing malformed enhanced audio/video tagsA flaw was found in GStreamer's gst-plugins-good package. The FLV media demuxer does not properly validate buffer sizes and data availability when processing enhanced audio and video tags in malformed or truncated FLV streams. A remote attacker could exploit this vulnerability by providing a specially crafted FLV media file that, when opened or streamed by a GStreamer-based application, triggers an assertion failure or a process crash, leading to denial of service.CVSS6.5MediumEPSS0.56%RoutineCVE-2026-119842gstreamer project · gst-plugins-base +2 moreGst-plugins-base: gst-plugins-base: null-pointer dereference in mdvdsub subtitle parser via missing closing-brace checkA flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing the application to crash when a user opens or plays media with a malformed MicroDVD (.sub) subtitle file.CVSS6.5MediumEPSS0.33%RoutineCVE-2026-119727gstreamer project · gst-plugins-bad +2 moreGst-plugins-bad: gst-plugins-bad: h.265 sps scc palette predictor array overflow via integer underflow in bounds computationA flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the parser to accept an out-of-range value for the number of palette predictor entries. This causes the parser to write beyond the end of a fixed-size array, resulting in memory corruption and an application crash. Successful exploitation requires an attacker to provide a malformed H.265 media file to a vulnerable application, and is limited to a denial-of-service impact.CVSS6.5MediumEPSS0.25%RoutineCVE-2026-119729gstreamer project · gst-plugins-bad +5 moreGst-plugins-base: gst-plugins-bad: gst-plugins-base/gst-plugins-bad: integer overflow in av1 leb128 parser allows denial of serviceA flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker can cause integer overflow in the parser, resulting in incorrect length values being used during stream processing, which can lead to a denial of service.CVSS6.5MediumEPSS0.40%RoutineCVE-2026-116612gstreamer project · gst-editing-services +2 moregstreamer project gst-editing-servicesA flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager thumbnailing service that uses GStreamer autoplugging, the pipeline description is parsed and instantiated without restriction on which elements may be used or which properties may be set. A remote attacker who can deliver a crafted project file to a victim's system can trigger reading or writing of arbitrary local files, issue outbound network requests to attacker-controlled servers, or cause the application to crash. Under certain conditions the file-write capability may be leveraged to achieve code execution.CVSS7.8HighEPSS0.23%PrioritiseCVE-2020-6095gstreamer_project · gst-rtsp-server +7 moregstreamer_project gst-rtsp-serverAn exploitable denial of service vulnerability exists in the GstRTSPAuth functionality of GStreamer/gst-rtsp-server 1.14.5. A specially crafted RTSP setup request can cause a null pointer deference resulting in denial-of-service. An attacker can send a malicious packet to trigger this vulnerability.CVSS7.5HighEPSS2.94%