Integer Overflow Vulnerability in GStreamer Affecting Remote Code Execution
CVE-2026-2921

7.8HIGH

Key Information:

Vendor

Gstreamer

Status
Gstreamer
Vendor
CVE Published:
13 March 2026

What is CVE-2026-2921?

A critical vulnerability exists in GStreamer related to the processing of palette data in AVI files. The flaw arises from inadequate validation of user-supplied data, which can lead to an integer overflow when writing to memory. An attacker with the ability to interact with the library could exploit this weakness to execute arbitrary code within the context of the affected process. Various attack vectors are possible depending on the specific implementation of the library.

Affected Version(s)

GStreamer 1c6e163aa33962f5ee4a87d29319ccdd5cb67612

References

https://www.zerodayinitiative.com/advisories/ZDI-26-168/
x_research-advisory
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/comm...
vendor-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.