IT SBIT Services
Schneeberger
DEEN
CVE tracker

gst-plugins-base: Heap buffer overflow via unvalidated video metadata

CVE-2026-86476High 8.4Public exploit

← All vulnerabilities

Summary

The GStreamer base plugins (gst-plugins-base, libgstvideo) contain a heap buffer overflow. Video buffers carrying GstVideoMeta with plane strides and offsets that exceed the allocated memory are not validated before use. A local attacker who controls the sending side of a GStreamer inter-process pipeline, such as one using the unixfd plugin, can crash the receiving process and may be able to read, write or execute code within it. The attack requires a specific IPC setup, and no exploitation has been observed.

Affected

  • Red Hat Enterprise Linux 6, 7, 8, 9 and 10 (listed as affected in the CNA record; package versions not confirmed)
  • Azure Linux: gstreamer1-plugins-base 1.20.0-3 (listed by OSV)
  • Cross-process attack path: GStreamer 1.24 or later with the unixfd plugin
  • In-process use: earlier GStreamer versions may also be affected

Fixed in

Unknown.

  • Upstream expects a fix in GStreamer 1.28.8 (target approximately October 2026).
  • No vendor errata listing CVE-2026-86476 was found at the time of writing.

Workaround

  • Build or deploy GStreamer without the unixfd plugin (for example meson option -Dgst-plugins-bad:unixfd=disabled, or remove libgstunixfd.so), if inter-process video sharing via unixfd is not required.
  • Do not connect receiver pipelines to Unix socket endpoints controlled by untrusted local processes.
  • This does not fix the underlying validation gap for in-process use.

Exploitation

  • No evidence of exploitation in the wild; not listed in CISA KEV.
  • CISA SSVC: exploitation none, not automatable, total technical impact.
  • No public proof of concept found.
  • EPSS 0.00209 (low).

Our recommendation

  • Inventory systems with gstreamer1-plugins-base or gst-plugins-base installed (for example rpm -q or dpkg -l).
  • Disable the unixfd plugin where it is not needed and restrict local access on multi-user hosts.
  • Apply vendor updates as soon as they are published and check the Red Hat and Debian trackers for errata.
  • Prioritise multi-user Linux hosts and media appliances that pass video buffers between processes.

Public exploits

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:26.

Original description (NVD)

A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-checked during deserialization, and the video frame mapping code does not verify that the declared plane geometry fits within the buffer before allowing consumers to read or write video data. A local attacker who controls the sending side of a GStreamer inter-process IPC pipeline can deliver a crafted buffer carrying fabricated strides, causing the receiving process to read or write beyond heap boundaries. Successful exploitation can cause a denial of service or potentially allow code execution within the affected process.

NVD references (3)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed