{"kind": "product", "path": "vulns/debian-13/gst-plugins-bad1.0", "name": "gst-plugins-bad1.0", "product": "gst-plugins-bad1.0", "ecosystem": "Debian:13", "items": [{"id": "CVE-2026-100229", "noindex": false, "published": "2026-10-14T10:02:12.688Z", "modified": "2026-10-14T14:11:54.060Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "severity": "medium", "epss": 0.00364, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-100229", "title": "Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds write in gst_h266_parser_parse_dci() due to off-by-one array bound check", "description": "A flaw was found in GStreamer's H.266 codec parser library (libgstcodecparsers). An out-of-bounds write vulnerability exists in the DCI parsing function, where a reserved field value is incorrectly accepted, causing the parser to write beyond the bounds of an internal structure. An attacker could exploit this by providing a specially crafted H.266 bitstream to a third-party application that uses this library API, potentially causing a crash or memory corruption. No standard GStreamer pipeline element currently invokes the affected code path.", "references": ["https://access.redhat.com/security/cve/CVE-2026-100229", "https://bugzilla.redhat.com/show_bug.cgi?id=2541471", "https://nvd.nist.gov/vuln/detail/CVE-2026-100229"], "fixes": [], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-13/gst-plugins-bad1.0", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-100231", "noindex": false, "published": "2026-10-14T10:00:54.252Z", "modified": "2026-10-15T15:08:52.260Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "severity": "medium", "epss": 0.00151, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-100231", "title": "Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: heap out-of-bounds write in asfmux due to incorrect utf-16 size calculation for non-bmp characters", "description": "A flaw was found in the GStreamer multimedia framework's ASF muxer plugin (asfmux). When writing string metadata tags containing Unicode characters outside the Basic Multilingual Plane (such as emoji) to an ASF container, the plugin incorrectly calculates the buffer size needed for the UTF-16LE representation. The size calculation assumes each Unicode code point requires 2 bytes, but non-BMP characters require 4 bytes (surrogate pairs). This leads to a heap out-of-bounds write when the actual UTF-16LE conversion is written into the undersized buffer. An attacker could exploit this by providing media with crafted metadata tags to an applicatio", "references": ["https://access.redhat.com/security/cve/CVE-2026-100231", "https://bugzilla.redhat.com/show_bug.cgi?id=2541468", "https://nvd.nist.gov/vuln/detail/CVE-2026-100231"], "fixes": [], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-13/gst-plugins-bad1.0", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-19387", "noindex": false, "published": "2026-08-10T02:36:52.235Z", "modified": "2026-09-18T08:15:36.351Z", "cvss": 7.6, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "severity": "high", "epss": 0.0038, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-19387", "title": "Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec ima/dvi adpcm decoder", "description": "A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. This can lead to application crash, denial of service, memory corruption, or potentially arbitrary code execution when untrusted media is processed.", "references": ["https://access.redhat.com/errata/RHSA-2026:55433", "https://access.redhat.com/errata/RHSA-2026:55865", "https://access.redhat.com/errata/RHSA-2026:56521"], "fixes": ["1.26.2-3+deb13u3"], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-13/gst-plugins-bad1.0", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-59692", "noindex": false, "published": "2026-07-09T09:35:31.557Z", "modified": "2026-09-10T14:43:22.921Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00577, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-59692", "title": "Gstreamer1-plugins-bad-free: gstreamer: dtls certificate subject dn stack buffer overflow in openssl_verify_callback", "description": "A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed into a fixed-size 2048-byte stack buffer without bounds checking. A remote unauthenticated attacker can send a certificate with an oversized Subject DN that exceeds the buffer, causing a stack buffer overflow and process crash, resulting in denial of service.", "references": ["https://access.redhat.com/errata/RHSA-2026:47179", "https://access.redhat.com/errata/RHSA-2026:47180", "https://access.redhat.com/errata/RHSA-2026:47731"], "fixes": [], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-13/gst-plugins-bad1.0", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-59691", "noindex": false, "published": "2026-07-09T09:34:47.743Z", "modified": "2026-09-10T14:43:34.044Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "severity": "high", "epss": 0.00326, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-59691", "title": "Gstreamer1-plugins-bad-free: gstreamer: rfbsrc/librfb hextile heap out-of-bounds write with 16bpp framebuffer", "description": "A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values into a buffer allocated for 16-bit pixels. This type mismatch causes an out-of-bounds heap write that can lead to denial of service (process crash) and potential memory corruption.", "references": ["https://access.redhat.com/errata/RHSA-2026:47179", "https://access.redhat.com/errata/RHSA-2026:47180", "https://access.redhat.com/errata/RHSA-2026:47731"], "fixes": [], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-13/gst-plugins-bad1.0", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-14935", "noindex": false, "published": "2026-07-07T15:37:58.898Z", "modified": "2026-09-10T17:27:23.306Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "low", "epss": 0.00233, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-14935", "title": "Gstreamer1-plugins-bad-free: gstreamer: webrtcbin accepts remote sdp without a=fingerprint due to inverted presence check", "description": "A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto() function contains an inverted boolean condition that causes it to accept remote SDP offers or answers that lack the required a=fingerprint attribute, while incorrectly rejecting those that include it. An attacker with the ability to intercept and modify WebRTC signaling messages could exploit this to bypass the SDP-level DTLS certificate fingerprint binding, weakening defenses against man-in-the-middle attacks on media streams.", "references": ["https://access.redhat.com/security/cve/CVE-2026-14935", "https://bugzilla.redhat.com/show_bug.cgi?id=2497679", "https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/98"], "fixes": [], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-13/gst-plugins-bad1.0", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-12892", "noindex": false, "published": "2026-06-23T19:53:23.402Z", "modified": "2026-09-10T17:22:58.295Z", "cvss": 4.4, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L", "severity": "medium", "epss": 0.00157, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-12892", "title": "Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad: 1-byte heap out-of-bounds read in h.264 nal extension slice parser", "description": "A flaw was found in GStreamer's gst-plugins-bad package. When processing a specially crafted H.264 video file containing malformed MVC or SVC extension slice NAL units, a 1-byte heap out-of-bounds read can occur during parsing. This happens when the parser attempts to check slice boundary information without first verifying that the NAL unit contains enough data beyond the extension header. An attacker could exploit this by tricking a user into opening a malicious H.264 video file, potentially causing the application to crash or leak a single byte of heap memory.", "references": ["https://access.redhat.com/security/cve/CVE-2026-12892", "https://bugzilla.redhat.com/show_bug.cgi?id=2491321", "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5108"], "fixes": ["1.26.2-3+deb13u3"], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-13/gst-plugins-bad1.0", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-12891", "noindex": false, "published": "2026-06-23T19:53:21.692Z", "modified": "2026-09-10T17:23:04.482Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00387, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-12891", "title": "Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad: global buffer overflow (oob read) in h.266/vvc vui parameter parser", "description": "A flaw was found in the GStreamer gst-plugins-bad package. When processing a malformed H.266/VVC video stream with a crafted aspect ratio indicator value, the H.266 parser performs an out-of-bounds read of up to 8 bytes from adjacent memory. This flaw allows an attacker to craft a malicious H.266 video file or stream that, when processed by a GStreamer-based application, could leak limited memory contents through video metadata, potentially exposing sensitive information from the application's address space.", "references": ["https://access.redhat.com/security/cve/CVE-2026-12891", "https://bugzilla.redhat.com/show_bug.cgi?id=2491318", "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5109"], "fixes": ["1.26.2-3+deb13u3"], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-13/gst-plugins-bad1.0", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-52718", "noindex": false, "published": "2026-06-15T19:15:26.786Z", "modified": "2026-07-30T08:23:58.462Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00709, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-52718", "title": "Gstreamer1-plugins-bad-free: gstreamer: denial of service via av1 tile_list_obu parser byte/bit confusion", "description": "A denial of service vulnerability was found in GStreamer's AV1 codec parser in gst-plugins-bad. The gst_av1_parser_parse_tile_list_obu() function passes a byte count to a bit-reader API that expects a bit count, causing parser desynchronization. A remote attacker could trick a user into opening a specially crafted AV1 media file, triggering an assertion abort and causing the application to crash.", "references": ["https://access.redhat.com/errata/RHSA-2026:36749", "https://access.redhat.com/errata/RHSA-2026:36834", "https://access.redhat.com/errata/RHSA-2026:47069"], "fixes": ["1.26.2-3+deb13u2"], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-13/gst-plugins-bad1.0", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-52722", "noindex": false, "published": "2026-06-15T19:15:23.846Z", "modified": "2026-08-03T12:06:00.977Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "severity": "high", "epss": 0.00392, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-52722", "title": "Gstreamer1-plugins-bad-free: gstreamer: signed integer overflow in vmnc decoder cursor payload handling", "description": "A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a specially crafted VMnc file, potentially causing a crash or information disclosure.", "references": ["https://access.redhat.com/errata/RHSA-2026:36749", "https://access.redhat.com/errata/RHSA-2026:36834", "https://access.redhat.com/errata/RHSA-2026:37130"], "fixes": ["1.26.2-3+deb13u3"], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-13/gst-plugins-bad1.0", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-52720", "noindex": false, "published": "2026-06-15T19:15:19.808Z", "modified": "2026-08-03T12:05:46.793Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00638, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-52720", "title": "Gstreamer1-plugins-bad-free: gstreamer: heap buffer overflow via crafted vnc server rectangle in librfb", "description": "A heap buffer overflow vulnerability was found in GStreamer's librfb (RFB/VNC client). The rectangle bounds check incorrectly validates area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebuffer. A remote attacker could set up a malicious VNC server and trick a user into connecting, resulting in an out-of-bounds heap write that could lead to code execution or a crash.", "references": ["https://access.redhat.com/errata/RHSA-2026:36749", "https://access.redhat.com/errata/RHSA-2026:36834", "https://access.redhat.com/errata/RHSA-2026:37130"], "fixes": ["1.26.2-3+deb13u3"], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-13/gst-plugins-bad1.0", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-52721", "noindex": false, "published": "2026-06-15T19:10:29.514Z", "modified": "2026-06-15T19:39:06.995Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H", "severity": "medium", "epss": 0.00146, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-52721", "title": "Gstreamer1-plugins-bad-free: gstreamer: multiple out-of-bounds reads in pcapparse ipv4/tcp header parsing", "description": "Multiple out-of-bounds read vulnerabilities were found in GStreamer's pcapparse element. Malformed PCAP records can trigger reads beyond buffer boundaries during IPv4/TCP header parsing. This element is primarily used in debugging pipelines, limiting real-world exposure. A local attacker could trick a user into processing a specially crafted PCAP file, potentially leading to a crash or information disclosure.", "references": ["https://access.redhat.com/security/cve/CVE-2026-52721", "https://bugzilla.redhat.com/show_bug.cgi?id=2486732", "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5106"], "fixes": [], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-13/gst-plugins-bad1.0", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-52719", "noindex": false, "published": "2026-06-15T19:10:19.505Z", "modified": "2026-07-30T12:05:08.501Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "severity": "high", "epss": 0.00627, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-52719", "title": "Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds read via jpeg segment length validation in va decoder", "description": "An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser reads a segment length value from the bitstream without validating it against available data. A remote attacker could trick a user into opening a specially crafted JPEG file, causing downstream parsing to read beyond the provided input buffer, leading to a crash or potential information disclosure.", "references": ["https://access.redhat.com/errata/RHSA-2026:36749", "https://access.redhat.com/errata/RHSA-2026:36834", "https://access.redhat.com/errata/RHSA-2026:47070"], "fixes": ["1.26.2-3+deb13u2"], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-13/gst-plugins-bad1.0", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-53702", "noindex": false, "published": "2026-06-11T18:15:38.857Z", "modified": "2026-06-15T18:46:59.662Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00397, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-53702", "title": "Gstreamer1-plugins-bad-free: gstreamer: stack buffer overflow in h.265 buffering period sei parser", "description": "A stack buffer overflow flaw was found in the GStreamer H.265 codec parser library (gst-plugins-bad). When parsing a buffering period SEI message, the parser uses an incorrect loop bound derived from cpb_cnt_minus1[i] (the loop index) instead of the sub-layer 0 CPB count cpb_cnt_minus1[0] from the referenced Sequence Parameter Set. A crafted H.265 video file or stream can cause the parser to write beyond the bounds of stack-allocated CPB delay arrays, resulting in a crash or potential stack memory corruption.", "references": ["https://access.redhat.com/security/cve/CVE-2026-53702", "https://bugzilla.redhat.com/show_bug.cgi?id=2487612", "https://nvd.nist.gov/vuln/detail/CVE-2026-53702"], "fixes": [], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-13/gst-plugins-bad1.0", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-53701", "noindex": false, "published": "2026-06-11T18:15:30.104Z", "modified": "2026-06-15T18:46:57.811Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00367, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-53701", "title": "Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds write in h.266/vvc pps picture partition parser", "description": "An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser in gst-plugins-bad. In the multi-slice-in-tile processing of gst_h266_parser_parse_picture_partition() (gsth266parser.c), the loop iterates without checking that the slice index stays within bounds, writing past three fixed-size arrays (slice_height_in_ctus, slice_top_left_ctu_x, slice_top_left_ctu_y) in the GstH266PPS structure. While the initial proof-of-concept demonstrated a 4-byte out-of-bounds write, the code permits larger writes across multiple iterations. A crafted H.266/VVC media file can trigger this vulnerability.", "references": ["https://access.redhat.com/security/cve/CVE-2026-53701", "https://bugzilla.redhat.com/show_bug.cgi?id=2487611", "https://nvd.nist.gov/vuln/detail/CVE-2026-53701"], "fixes": ["1.26.2-3+deb13u2"], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-13/gst-plugins-bad1.0", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-3084", "noindex": false, "published": "2026-03-13T20:42:03.443Z", "modified": "2026-07-15T01:09:49.917Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00329, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-3084", "title": "GStreamer H.266 Codec Parser Integer Underflow Remote Code Execution Vulnerability", "description": "GStreamer H.266 Codec Parser Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the parsing of picture partitions. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28", "references": ["https://www.zerodayinitiative.com/advisories/ZDI-26-169/", "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/496e4f296e658fba7fd40027d3bbe6095633ec91", "https://access.redhat.com/security/cve/CVE-2026-3084"], "fixes": ["1.26.2-3+deb13u1"], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-13/gst-plugins-bad1.0", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-3086", "noindex": false, "published": "2026-03-13T20:40:12.973Z", "modified": "2026-07-15T01:09:44.630Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00329, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-3086", "title": "GStreamer H.266 Codec Parser Out-Of-Bounds Write Remote Code Execution Vulnerability", "description": "GStreamer H.266 Codec Parser Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the processing of APS units. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28911.", "references": ["https://www.zerodayinitiative.com/advisories/ZDI-26-170/", "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/025d59cf3459c2903f0384b6b94bc3235e177b53", "https://access.redhat.com/security/cve/CVE-2026-3086"], "fixes": ["1.26.2-3+deb13u1"], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-13/gst-plugins-bad1.0", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-3082", "noindex": false, "published": "2026-03-13T20:39:33.772Z", "modified": "2026-07-21T12:05:09.274Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00397, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-3082", "title": "GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability", "description": "GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the processing of Huffman tables. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CA", "references": ["https://www.zerodayinitiative.com/advisories/ZDI-26-163/", "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/7d3c258ed928cf59d126c8ea926b185f046f444c", "https://access.redhat.com/security/cve/CVE-2026-3082"], "fixes": ["1.26.2-3+deb13u1"], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-13/gst-plugins-bad1.0", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-3081", "noindex": false, "published": "2026-03-13T20:39:20.596Z", "modified": "2026-07-15T01:09:57.633Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00356, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-3081", "title": "GStreamer H.266 Codec Parser Stack-based Buffer Overflow Remote Code Execution Vulnerability", "description": "GStreamer H.266 Codec Parser Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the parsing of decoding units. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ", "references": ["https://www.zerodayinitiative.com/advisories/ZDI-26-162/", "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/2ffdfca2df95a7f605c922d3111e5d5be5314dca", "https://access.redhat.com/security/cve/CVE-2026-3081"], "fixes": ["1.26.2-3+deb13u1"], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-13/gst-plugins-bad1.0", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-2923", "noindex": false, "published": "2026-03-13T20:39:01.199Z", "modified": "2026-07-21T12:04:59.117Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00353, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-2923", "title": "GStreamer DVB Subtitles Out-Of-Bounds Write Remote Code Execution Vulnerability", "description": "GStreamer DVB Subtitles Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the handling of coordinates. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28838.", "references": ["https://www.zerodayinitiative.com/advisories/ZDI-26-161/", "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/3b8253f447bcc9831dbf643d2c69b205fedbe086", "https://access.redhat.com/security/cve/CVE-2026-2923"], "fixes": ["1.26.2-3+deb13u1"], "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-13/gst-plugins-bad1.0", "ecosystem": "Debian:13"}]}], "total": 38, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "gst-plugins-bad1.0", "path": "vulns/debian-13/gst-plugins-bad1.0", "ecosystem": "Debian:13"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 2, "kev": 0}, "lastmod": "2026-10-15T15:08:52.260Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}