Heap Buffer Overflow in GStreamer Affects gst-plugins-base by Red Hat

CVE-2026-86476

What is CVE-2026-86476?

A flaw exists in the gst-plugins-base that allows a heap buffer overflow through improper handling of video buffer metadata. Specifically, when processing video buffers with GstVideoMeta metadata that specifies plane strides and offsets exceeding the size of the memory allocated, issues arise. The deserialization of this metadata lacks proper range checking, enabling attackers to exploit this vulnerability via a crafted buffer in a GStreamer inter-process communication pipeline. A local attacker can manipulate the pipe's data, leading to unauthorized access beyond allocated memory, potentially resulting in denial of service or unauthorized code execution within the affected process.

References