Description
A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-checked during deserialization, and the video frame mapping code does not verify that the declared plane geometry fits within the buffer before allowing consumers to read or write video data. A local attacker who controls the sending side of a GStreamer inter-process IPC pipeline can deliver a crafted buffer carrying fabricated strides, causing the receiving process to read or write beyond heap boundaries. Successful exploitation can cause a denial of service or potentially allow code execution within the affected process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.2 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gst-plugins-base1.0 | No fix yet | — |
| Debian 13 | gst-plugins-base1.0 | No fix yet | — |
| Debian 12 | gst-plugins-base1.0 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | gst-plugins-base1.0 | No fix yet | — |
| Ubuntu 26.04 LTS | gst-plugins-base1.0 | No fix yet | — |
| Ubuntu 24.04 LTS | gst-plugins-base1.0 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | gstreamer1-plugins-base +2 | 1.26.7-4.el10_3.1 | RHSA-2026:98600 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.2 EUS | gstreamer1-plugins-base +2 | 1.26.7-2.el10_2.3 | RHSA-2026:99033 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | gstreamer1-plugins-base +2 | 1.26.7-4.el10_3.1 | RLSA-2026:98600 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | gstreamer1-plugins-base +2 | 1.24.10-1.amzn2023.0.6 | ALAS2023-2026-3397 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | gstreamer1-plugins-base | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
0xSemizzz/CVE-2026-86476 ★ 0 · Oct 23, 2026
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 5
- RHSA-2026:99033 Red Hat Security Advisory: gstreamer1-plugins-base security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:98600 Red Hat Security Advisory: gstreamer1-plugins-base security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RLSA-2026:98600 Important: gstreamer1-plugins-base security update Rocky Linux Security Advisories · Nov 13, 2026
- WID-SEC-2026-3827 GStreamer: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- ALAS2023-2026-3397 Important: gstreamer1-plugins-base security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 9, 2026
References
- RHSA-2026:98600 vendor-advisory
- RHSA-2026:99033 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-86476 vdb-entry
- RHBZ#2529510 issue-tracking
- https://redhat.atlassian.net/browse/PSIRTSUPT-23320