CVE-2026-86476

Awaiting Analysis Awaiting Analysis - Queue

Heap Buffer Overflow in GStreamer Base Plugins

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: redhat-SADP

Description

A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-checked during deserialization, and the video frame mapping code does not verify that the declared plane geometry fits within the buffer before allowing consumers to read or write video data. A local attacker who controls the sending side of a GStreamer inter-process IPC pipeline can deliver a crafted buffer carrying fabricated strides, causing the receiving process to read or write beyond heap boundaries. Successful exploitation can cause a denial of service or potentially allow code execution within the affected process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-86476

EUVD

EUVD-2026-100950

Affected Vendors & Products

Vendor	Product	Version / Range
Red	Hat	Red Hat Enterprise Linux 10 *
Red	Hat	Red Hat Enterprise Linux 6 *
Red	Hat	Red Hat Enterprise Linux 7 *
Red	Hat	Red Hat Enterprise Linux 8 *
Red	Hat	Red Hat Enterprise Linux 9 *

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

CVE-2026-86476 is a heap buffer overflow in the gst-plugins-base library of the GStreamer multimedia framework. It occurs when video buffers with GstVideoMeta metadata declare plane strides and offsets that exceed the actual memory allocation. The metadata is not validated during deserialization, and the video frame mapping code fails to check if the declared plane geometry fits within the buffer. This allows attackers to send crafted video metadata, causing out-of-bounds memory access.

Detection Guidance

To detect this vulnerability, monitor for heap buffer overflows in gst-plugins-base using tools like AddressSanitizer (ASan) during video processing. Check for crashes or memory corruption in applications using GStreamer with video metadata handling. Inspect logs for segmentation faults or heap corruption errors in processes linked to gst-plugins-base.

Impact Analysis

This vulnerability can lead to denial of service or arbitrary code execution in the affected process. An attacker controlling the sending side of a GStreamer IPC pipeline could exploit it by delivering maliciously crafted video metadata. Successful exploitation may crash the application or allow the attacker to run arbitrary code with the permissions of the vulnerable process.

Compliance Impact

This vulnerability primarily affects memory safety in video processing, leading to potential denial of service or code execution. It does not directly impact compliance with GDPR or HIPAA, as those standards focus on data protection, privacy, and security controls rather than memory management flaws in multimedia libraries.

Mitigation Strategies

Disable the unixfd plugin in GStreamer builds using meson option `-Dgst-plugins-bad:unixfd=disabled` or remove `libgstunixfd.so`. Avoid connecting to Unix socket endpoints controlled by untrusted local processes. Update to GStreamer 1.28.8 once available. Apply standard compiler hardening measures like PIE, Full RELRO, and ASLR if not already enabled.

Hi! I’m here to help you understand CVE-2026-86476. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70