CVE-2026-53704: gst-plugins-ugly1.0 Out-of-bounds Read
Vulnerability summary
CVE-2026-53704 is a high (CVSS 7.1) Out-of-bounds Read vulnerability in gst-plugins-ugly1.0. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 38.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 5 · Related 1Timeline
- 15-06-2026PublishedVulnerability first disclosed.
- 08-09-2026Last modifiedVulnerability information updated.
Description
A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a RealMedia file containing a specially crafted FILEINFO metadata section, the demuxer parses variable-name and variable-value pairs using re_skip_pascal_string() without validating that offsets remain within the mapped buffer. Additionally, the element count controlling the parsing loop is read from attacker-controlled data without validation, which can cause an infinite loop. A crafted RealMedia file can cause the application to crash, hang, or potentially read limited adjacent memory contents.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
- NVDNIST7.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
EPSS trend
Probability
0.46%
Chance of exploitation in the next 30 days
Percentile
39%
Versus all other CVEs
30-day change
+0.21 pp
From 0.24% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- gst-plugins-ugly1.0All versions (No fix recorded) | < 1.28.4-1
Ubuntu1 product
- gst-plugins-ugly1.0< 1.8.3-1ubuntu0.1+esm2 | < 1.14.5-0ubuntu1~18.04.1+esm1 | < 1.16.2-2ubuntu0.1~esm1 | < 1.20.1-1ubuntu0.1~esm1 | < 1.24.1-1ubuntu0.1~esm1 | All versions (No fix recorded) | < 1.28.2-1ubuntu0.1~esm1
2 vendors · 2 products
