GStreamer H.266 Codec Parser Vulnerability in GStreamer Software by FreeDesktop
CVE-2026-3081

7.8HIGH

Key Information:

Vendor

Gstreamer

Status
Gstreamer
Vendor
CVE Published:
13 March 2026

What is CVE-2026-3081?

The vulnerability affects the GStreamer library’s handling of decoding units within the H.266 Codec Parser, where insufficient validation of user-supplied data lengths leads to a stack-based buffer overflow. This flaw allows remote attackers to execute arbitrary code in the context of the current process, posing significant risks depending on how the library is implemented across applications. Proper interaction with this library is necessary for exploitation, making the threat contingent on the deployment scenario.

Affected Version(s)

GStreamer 1c6e163aa33962f5ee4a87d29319ccdd5cb67612

References

https://www.zerodayinitiative.com/advisories/ZDI-26-162/
x_research-advisory
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/comm...
vendor-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.