Remote Code Execution Flaw in GStreamer by Freedesktop
CVE-2026-3085

8.8HIGH

Key Information:

Vendor

Gstreamer

Status
Gstreamer
Vendor
CVE Published:
13 March 2026

What is CVE-2026-3085?

A heap-based buffer overflow vulnerability exists within GStreamer affecting the processing of X-QDM RTP payloads. This flaw arises due to improper validation of the length of user-supplied data, which could potentially allow remote attackers to execute arbitrary code within the context of the affected application. Exploitation requires interaction with the GStreamer library, highlighting the need for careful handling and validation of RTP payload data to mitigate such risks.

Affected Version(s)

GStreamer 1c6e163aa33962f5ee4a87d29319ccdd5cb67612

References

https://www.zerodayinitiative.com/advisories/ZDI-26-167/
x_research-advisory
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/comm...
vendor-advisory

CVSS V3.0

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.