{"kind": "product", "path": "vulns/debian-12/gst-plugins-bad1.0", "name": "gst-plugins-bad1.0", "product": "gst-plugins-bad1.0", "ecosystem": "Debian:12", "items": [{"id": "CVE-2026-100229", "noindex": false, "published": "2026-10-14T10:02:12.688Z", "modified": "2026-10-14T14:11:54.060Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "severity": "medium", "epss": 0.00296, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-100229", "title": "Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds write in gst_h266_parser_parse_dci() due to off-by-one array bound check", "description": "A flaw was found in GStreamer's H.266 codec parser library (libgstcodecparsers). An out-of-bounds write vulnerability exists in the DCI parsing function, where a reserved field value is incorrectly accepted, causing the parser to write beyond the bounds of an internal structure. An attacker could exploit this by providing a specially crafted H.266 bitstream to a third-party application that uses this library API, potentially causing a crash or memory corruption. No standard GStreamer pipeline element currently invokes the affected code path.", "references": ["https://access.redhat.com/security/cve/CVE-2026-100229", "https://bugzilla.redhat.com/show_bug.cgi?id=2541471", "https://nvd.nist.gov/vuln/detail/CVE-2026-100229"], "fixes": [], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-12/gst-plugins-bad1.0", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-100231", "noindex": false, "published": "2026-10-14T10:00:54.252Z", "modified": "2026-10-15T15:08:52.260Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "severity": "medium", "epss": 0.00141, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-100231", "title": "Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: heap out-of-bounds write in asfmux due to incorrect utf-16 size calculation for non-bmp characters", "description": "A flaw was found in the GStreamer multimedia framework's ASF muxer plugin (asfmux). When writing string metadata tags containing Unicode characters outside the Basic Multilingual Plane (such as emoji) to an ASF container, the plugin incorrectly calculates the buffer size needed for the UTF-16LE representation. The size calculation assumes each Unicode code point requires 2 bytes, but non-BMP characters require 4 bytes (surrogate pairs). This leads to a heap out-of-bounds write when the actual UTF-16LE conversion is written into the undersized buffer. An attacker could exploit this by providing media with crafted metadata tags to an applicatio", "references": ["https://access.redhat.com/security/cve/CVE-2026-100231", "https://bugzilla.redhat.com/show_bug.cgi?id=2541468", "https://nvd.nist.gov/vuln/detail/CVE-2026-100231"], "fixes": [], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-12/gst-plugins-bad1.0", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-19387", "noindex": false, "published": "2026-08-10T02:36:52.235Z", "modified": "2026-09-18T08:15:36.351Z", "cvss": 7.6, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "severity": "high", "epss": 0.0038, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-19387", "title": "Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec ima/dvi adpcm decoder", "description": "A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. This can lead to application crash, denial of service, memory corruption, or potentially arbitrary code execution when untrusted media is processed.", "references": ["https://access.redhat.com/errata/RHSA-2026:55433", "https://access.redhat.com/errata/RHSA-2026:55865", "https://access.redhat.com/errata/RHSA-2026:56521"], "fixes": ["1.22.0-4+deb12u8"], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-12/gst-plugins-bad1.0", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-59692", "noindex": false, "published": "2026-07-09T09:35:31.557Z", "modified": "2026-09-10T14:43:22.921Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00577, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-59692", "title": "Gstreamer1-plugins-bad-free: gstreamer: dtls certificate subject dn stack buffer overflow in openssl_verify_callback", "description": "A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed into a fixed-size 2048-byte stack buffer without bounds checking. A remote unauthenticated attacker can send a certificate with an oversized Subject DN that exceeds the buffer, causing a stack buffer overflow and process crash, resulting in denial of service.", "references": ["https://access.redhat.com/errata/RHSA-2026:47179", "https://access.redhat.com/errata/RHSA-2026:47180", "https://access.redhat.com/errata/RHSA-2026:47731"], "fixes": ["1.22.0-4+deb12u8"], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-12/gst-plugins-bad1.0", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-59691", "noindex": false, "published": "2026-07-09T09:34:47.743Z", "modified": "2026-09-10T14:43:34.044Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "severity": "high", "epss": 0.00326, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-59691", "title": "Gstreamer1-plugins-bad-free: gstreamer: rfbsrc/librfb hextile heap out-of-bounds write with 16bpp framebuffer", "description": "A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values into a buffer allocated for 16-bit pixels. This type mismatch causes an out-of-bounds heap write that can lead to denial of service (process crash) and potential memory corruption.", "references": ["https://access.redhat.com/errata/RHSA-2026:47179", "https://access.redhat.com/errata/RHSA-2026:47180", "https://access.redhat.com/errata/RHSA-2026:47731"], "fixes": ["1.22.0-4+deb12u8"], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-12/gst-plugins-bad1.0", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-14935", "noindex": false, "published": "2026-07-07T15:37:58.898Z", "modified": "2026-09-10T17:27:23.306Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "low", "epss": 0.00233, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-14935", "title": "Gstreamer1-plugins-bad-free: gstreamer: webrtcbin accepts remote sdp without a=fingerprint due to inverted presence check", "description": "A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto() function contains an inverted boolean condition that causes it to accept remote SDP offers or answers that lack the required a=fingerprint attribute, while incorrectly rejecting those that include it. An attacker with the ability to intercept and modify WebRTC signaling messages could exploit this to bypass the SDP-level DTLS certificate fingerprint binding, weakening defenses against man-in-the-middle attacks on media streams.", "references": ["https://access.redhat.com/security/cve/CVE-2026-14935", "https://bugzilla.redhat.com/show_bug.cgi?id=2497679", "https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/98"], "fixes": ["1.22.0-4+deb12u8"], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-12/gst-plugins-bad1.0", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-12892", "noindex": false, "published": "2026-06-23T19:53:23.402Z", "modified": "2026-09-10T17:22:58.295Z", "cvss": 4.4, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L", "severity": "medium", "epss": 0.00157, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-12892", "title": "Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad: 1-byte heap out-of-bounds read in h.264 nal extension slice parser", "description": "A flaw was found in GStreamer's gst-plugins-bad package. When processing a specially crafted H.264 video file containing malformed MVC or SVC extension slice NAL units, a 1-byte heap out-of-bounds read can occur during parsing. This happens when the parser attempts to check slice boundary information without first verifying that the NAL unit contains enough data beyond the extension header. An attacker could exploit this by tricking a user into opening a malicious H.264 video file, potentially causing the application to crash or leak a single byte of heap memory.", "references": ["https://access.redhat.com/security/cve/CVE-2026-12892", "https://bugzilla.redhat.com/show_bug.cgi?id=2491321", "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5108"], "fixes": ["1.22.0-4+deb12u8"], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-12/gst-plugins-bad1.0", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-52718", "noindex": false, "published": "2026-06-15T19:15:26.786Z", "modified": "2026-07-30T08:23:58.462Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00386, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-52718", "title": "Gstreamer1-plugins-bad-free: gstreamer: denial of service via av1 tile_list_obu parser byte/bit confusion", "description": "A denial of service vulnerability was found in GStreamer's AV1 codec parser in gst-plugins-bad. The gst_av1_parser_parse_tile_list_obu() function passes a byte count to a bit-reader API that expects a bit count, causing parser desynchronization. A remote attacker could trick a user into opening a specially crafted AV1 media file, triggering an assertion abort and causing the application to crash.", "references": ["https://access.redhat.com/errata/RHSA-2026:36749", "https://access.redhat.com/errata/RHSA-2026:36834", "https://access.redhat.com/errata/RHSA-2026:47069"], "fixes": ["1.22.0-4+deb12u8"], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-12/gst-plugins-bad1.0", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-52720", "noindex": false, "published": "2026-06-15T19:15:19.808Z", "modified": "2026-08-03T12:05:46.793Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00638, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-52720", "title": "Gstreamer1-plugins-bad-free: gstreamer: heap buffer overflow via crafted vnc server rectangle in librfb", "description": "A heap buffer overflow vulnerability was found in GStreamer's librfb (RFB/VNC client). The rectangle bounds check incorrectly validates area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebuffer. A remote attacker could set up a malicious VNC server and trick a user into connecting, resulting in an out-of-bounds heap write that could lead to code execution or a crash.", "references": ["https://access.redhat.com/errata/RHSA-2026:36749", "https://access.redhat.com/errata/RHSA-2026:36834", "https://access.redhat.com/errata/RHSA-2026:37130"], "fixes": ["1.22.0-4+deb12u8"], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-12/gst-plugins-bad1.0", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-52721", "noindex": false, "published": "2026-06-15T19:10:29.514Z", "modified": "2026-06-15T19:39:06.995Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H", "severity": "medium", "epss": 0.00107, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-52721", "title": "Gstreamer1-plugins-bad-free: gstreamer: multiple out-of-bounds reads in pcapparse ipv4/tcp header parsing", "description": "Multiple out-of-bounds read vulnerabilities were found in GStreamer's pcapparse element. Malformed PCAP records can trigger reads beyond buffer boundaries during IPv4/TCP header parsing. This element is primarily used in debugging pipelines, limiting real-world exposure. A local attacker could trick a user into processing a specially crafted PCAP file, potentially leading to a crash or information disclosure.", "references": ["https://access.redhat.com/security/cve/CVE-2026-52721", "https://bugzilla.redhat.com/show_bug.cgi?id=2486732", "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5106"], "fixes": [], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-12/gst-plugins-bad1.0", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-52719", "noindex": false, "published": "2026-06-15T19:10:19.505Z", "modified": "2026-07-30T12:05:08.501Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "severity": "high", "epss": 0.00341, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-52719", "title": "Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds read via jpeg segment length validation in va decoder", "description": "An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser reads a segment length value from the bitstream without validating it against available data. A remote attacker could trick a user into opening a specially crafted JPEG file, causing downstream parsing to read beyond the provided input buffer, leading to a crash or potential information disclosure.", "references": ["https://access.redhat.com/errata/RHSA-2026:36749", "https://access.redhat.com/errata/RHSA-2026:36834", "https://access.redhat.com/errata/RHSA-2026:47070"], "fixes": ["1.22.0-4+deb12u8"], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-12/gst-plugins-bad1.0", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-53702", "noindex": false, "published": "2026-06-11T18:15:38.857Z", "modified": "2026-06-15T18:46:59.662Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00228, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-53702", "title": "Gstreamer1-plugins-bad-free: gstreamer: stack buffer overflow in h.265 buffering period sei parser", "description": "A stack buffer overflow flaw was found in the GStreamer H.265 codec parser library (gst-plugins-bad). When parsing a buffering period SEI message, the parser uses an incorrect loop bound derived from cpb_cnt_minus1[i] (the loop index) instead of the sub-layer 0 CPB count cpb_cnt_minus1[0] from the referenced Sequence Parameter Set. A crafted H.265 video file or stream can cause the parser to write beyond the bounds of stack-allocated CPB delay arrays, resulting in a crash or potential stack memory corruption.", "references": ["https://access.redhat.com/security/cve/CVE-2026-53702", "https://bugzilla.redhat.com/show_bug.cgi?id=2487612", "https://nvd.nist.gov/vuln/detail/CVE-2026-53702"], "fixes": ["1.22.0-4+deb12u8"], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-12/gst-plugins-bad1.0", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-3082", "noindex": false, "published": "2026-03-13T20:39:33.772Z", "modified": "2026-07-21T12:05:09.274Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00817, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-3082", "title": "GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability", "description": "GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the processing of Huffman tables. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CA", "references": ["https://www.zerodayinitiative.com/advisories/ZDI-26-163/", "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/7d3c258ed928cf59d126c8ea926b185f046f444c", "https://access.redhat.com/security/cve/CVE-2026-3082"], "fixes": ["1.22.0-4+deb12u7"], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-12/gst-plugins-bad1.0", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-2923", "noindex": false, "published": "2026-03-13T20:39:01.199Z", "modified": "2026-07-21T12:04:59.117Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00742, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-2923", "title": "GStreamer DVB Subtitles Out-Of-Bounds Write Remote Code Execution Vulnerability", "description": "GStreamer DVB Subtitles Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the handling of coordinates. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28838.", "references": ["https://www.zerodayinitiative.com/advisories/ZDI-26-161/", "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/3b8253f447bcc9831dbf643d2c69b205fedbe086", "https://access.redhat.com/security/cve/CVE-2026-2923"], "fixes": ["1.22.0-4+deb12u7"], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-12/gst-plugins-bad1.0", "ecosystem": "Debian:12"}]}, {"id": "DSA-5941-1", "noindex": false, "published": "2025-06-11T00:00:00Z", "modified": "2026-03-09T02:09:51.477162Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/dsa-5941-1", "title": "gst-plugins-bad1.0 - security update", "description": "gst-plugins-bad1.0 - security update", "references": ["https://osv.dev/vulnerability/DSA-5941-1"], "fixes": ["1.22.0-4+deb12u6"], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-12/gst-plugins-bad1.0", "ecosystem": "Debian:12"}]}, {"id": "CVE-2025-3887", "noindex": false, "published": "2025-05-22T00:47:04.097Z", "modified": "2025-06-17T23:03:10.566Z", "cvss": 8.8, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00913, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-3887", "title": "GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability", "description": "GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the parsing of H265 slice headers. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. ", "references": ["https://www.zerodayinitiative.com/advisories/ZDI-25-267/", "https://lists.debian.org/debian-lts-announce/2025/06/msg00017.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-3887"], "fixes": ["1.22.0-4+deb12u6"], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-12/gst-plugins-bad1.0", "ecosystem": "Debian:12"}]}, {"id": "CVE-2024-0444", "noindex": false, "published": "2024-06-07T22:49:46.768Z", "modified": "2024-08-01T18:04:49.612Z", "cvss": 7.5, "cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.01572, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-0444", "title": "GStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability", "description": "GStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the parsing of tile list data within AV1-encoded video files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the contex", "references": ["https://www.zerodayinitiative.com/advisories/ZDI-24-567/", "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/f368d63ecd89e01fd2cf0b1c4def5fc782b2c390", "https://nvd.nist.gov/vuln/detail/CVE-2024-0444"], "fixes": ["1.22.0-4+deb12u5"], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-12/gst-plugins-bad1.0", "ecosystem": "Debian:12"}]}, {"id": "CVE-2023-50186", "noindex": false, "published": "2024-05-03T02:14:13.976Z", "modified": "2024-08-02T22:09:49.773Z", "cvss": 7.5, "cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.01534, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-50186", "title": "GStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability", "description": "GStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the parsing of metadata within AV1 encoded video files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of t", "references": ["https://www.zerodayinitiative.com/advisories/ZDI-24-368/", "https://gstreamer.freedesktop.org/security/sa-2023-0011.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-50186"], "fixes": ["1.22.0-4+deb12u4"], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-12/gst-plugins-bad1.0", "ecosystem": "Debian:12"}]}, {"id": "CVE-2023-44446", "noindex": false, "published": "2024-05-03T02:14:08.770Z", "modified": "2025-11-04T19:25:23.848Z", "cvss": 8.8, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.01957, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-44446", "title": "GStreamer MXF File Parsing Use-After-Free Remote Code Execution Vulnerability", "description": "GStreamer MXF File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the parsing of MXF video files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22299.", "references": ["https://www.zerodayinitiative.com/advisories/ZDI-23-1647/", "https://gstreamer.freedesktop.org/security/sa-2023-0010.html", "https://lists.debian.org/debian-lts-announce/2023/11/msg00029.html"], "fixes": ["1.22.0-4+deb12u3"], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-12/gst-plugins-bad1.0", "ecosystem": "Debian:12"}]}, {"id": "CVE-2023-44429", "noindex": false, "published": "2024-05-03T02:13:56.137Z", "modified": "2024-08-02T20:07:33.447Z", "cvss": 8.8, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.01806, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-44429", "title": "GStreamer AV1 Codec Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability", "description": "GStreamer AV1 Codec Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the parsing of AV1 encoded video files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process", "references": ["https://www.zerodayinitiative.com/advisories/ZDI-23-1648/", "https://gstreamer.freedesktop.org/security/sa-2023-0009.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-44429"], "fixes": ["1.22.0-4+deb12u3"], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-12/gst-plugins-bad1.0", "ecosystem": "Debian:12"}]}], "total": 37, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-12/gst-plugins-bad1.0", "ecosystem": "Debian:12"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 2, "kev": 0}, "lastmod": "2026-10-15T15:08:52.260Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}