CVE-2021-3498
GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.
GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.
- Record
CVE-2021-3498- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-119, CWE-787
- Updated
- 2026-11-02
CVE List No score
GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.
- Record
CVE-2021-3498- Weakness
- CWE-119
- Updated
- 2026-11-02
EUVDEUVD-2021-26819 No score
GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.
- Record
EUVD-2021-26819- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hf4m-4x6v-4wvr
GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.
GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.
- Record
GHSA-hf4m-4x6v-4wvr- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-119, CWE-787
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-3498
GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.
- Record
ALPINE-CVE-2021-3498- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVBELL-CVE-2021-3498
CVE-2021-3498 does not affect BellSoft software
- Record
BELL-CVE-2021-3498- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 9 moreShow less
OSV
GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.
- Record
CVE-2021-3498- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-3498
GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.
- Record
DEBIAN-CVE-2021-3498- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2021-1322
gstreamer1-plugins-good security update
GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.
Security Fix(es):
GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.(CVE-2021-3497)
GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.(CVE-2021-3498)
- Record
OESA-2021-1322- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-3498
GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.
- Record
UBUNTU-CVE-2021-3498- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1230-1 No score
Security update for gstreamer-plugins-good
This update for gstreamer-plugins-good fixes the following issues:
- CVE-2021-3498: Matroskademux: initialize track context out parameter to NULL before parsing (bsc#1184735).
- CVE-2021-3497: Matroskademux: Fix extraction of multichannel WavPack (bsc#1184739).
This update was imported from the SUSE:SLE-15-SP2:Update update project.
- Record
openSUSE-SU-2021:1230-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:2915-1 No score
Security update for gstreamer-plugins-good
This update for gstreamer-plugins-good fixes the following issues:
- CVE-2021-3498: Matroskademux: initialize track context out parameter to NULL before parsing (bsc#1184735).
- CVE-2021-3497: Matroskademux: Fix extraction of multichannel WavPack (bsc#1184739).
- Record
openSUSE-SU-2021:2915-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11778-1 No score
gstreamer-plugins-good-1.18.5-3.1 on GA media
These are all security issues fixed in the gstreamer-plugins-good-1.18.5-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11778-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:2915-1 No score
Security update for gstreamer-plugins-good
This update for gstreamer-plugins-good fixes the following issues:
- CVE-2021-3498: Matroskademux: initialize track context out parameter to NULL before parsing (bsc#1184735).
- CVE-2021-3497: Matroskademux: Fix extraction of multichannel WavPack (bsc#1184739).
- Record
SUSE-SU-2021:2915-1- Updated
- 2026-11-02
OSVUSN-4928-1 No score
gst-plugins-good1.0 vulnerabilities
It was discovered that GStreamer Good Plugins incorrectly handled certain files. An attacker could possibly use this issue to cause access sensitive information or cause a crash. (CVE-2021-3497)
It was discovered that GStreamer Good Plugins incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code or cause a crash. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2021-3498)
- Record
USN-4928-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gst-plugins-goodAlpine:v3.13 |
before 1.18.4-r0 | 1.18.4-r0 |
gst-plugins-goodAlpine:v3.14 |
before 1.18.4-r0 | 1.18.4-r0 |
gst-plugins-goodAlpine:v3.15 |
before 1.18.4-r0 | 1.18.4-r0 |
gst-plugins-goodAlpine:v3.16 |
before 1.18.4-r0 | 1.18.4-r0 |
gst-plugins-goodAlpine:v3.17 |
before 1.18.4-r0 | 1.18.4-r0 |
gst-plugins-goodAlpine:v3.18 |
before 1.18.4-r0 | 1.18.4-r0 |
gst-plugins-goodAlpine:v3.19 |
before 1.18.4-r0 | 1.18.4-r0 |
gst-plugins-goodAlpine:v3.20 |
before 1.18.4-r0 | 1.18.4-r0 |
gst-plugins-goodAlpine:v3.21 |
before 1.18.4-r0 | 1.18.4-r0 |
gst-plugins-goodAlpine:v3.22 |
before 1.18.4-r0 | 1.18.4-r0 |
Show 29 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gst-plugins-goodAlpine:v3.23 |
before 1.18.4-r0 | 1.18.4-r0 |
gst-plugins-goodAlpine:v3.24 |
before 1.18.4-r0 | 1.18.4-r0 |
gstreamerAlpine:v3.13 |
1.0.0 up to 1.18.4-r0 | 1.18.4-r0 |
gstreamerAlpine:v3.14 |
1.0.0 up to 1.18.4-r0 | 1.18.4-r0 |
gstreamerAlpine:v3.15 |
1.0.0 up to 1.18.4-r0 | 1.18.4-r0 |
gstreamerAlpine:v3.16 |
1.0.0 up to 1.18.4-r0 | 1.18.4-r0 |
gstreamerAlpine:v3.17 |
1.0.0 up to 1.18.4-r0 | 1.18.4-r0 |
gstreamerAlpine:v3.18 |
1.0.0 up to 1.18.4-r0 | 1.18.4-r0 |
gstreamerAlpine:v3.19 |
1.0.0 up to 1.18.4-r0 | 1.18.4-r0 |
gstreamerAlpine:v3.20 |
1.0.0 up to 1.18.4-r0 | 1.18.4-r0 |
gstreamerAlpine:v3.21 |
1.0.0 up to 1.18.4-r0 | 1.18.4-r0 |
gstreamerAlpine:v3.22 |
1.0.0 up to 1.18.4-r0 | 1.18.4-r0 |
gstreamerAlpine:v3.23 |
1.0.0 up to 1.18.4-r0 | 1.18.4-r0 |
gstreamerAlpine:v3.24 |
1.0.0 up to 1.18.4-r0 | 1.18.4-r0 |
gst-plugins-good1.0Debian:12 |
before 1.18.4-2 | 1.18.4-2 |
gst-plugins-good1.0Debian:13 |
before 1.18.4-2 | 1.18.4-2 |
gst-plugins-good1.0Debian:14 |
before 1.18.4-2 | 1.18.4-2 |
gst-plugins-good1.0Debian:10 From an advisory covering 2 CVEs |
before 1.14.4-1+deb10u1, plus listed versions 1.14.4-1 |
1.14.4-1+deb10u1 |
gstreamer1-plugins-goodopenEuler:20.03-LTS-SP1 From an advisory covering 2 CVEs |
before 1.16.2-2.oe1 | 1.16.2-2.oe1 |
gstreamer1-plugins-goodopenEuler:20.03-LTS-SP2 From an advisory covering 2 CVEs |
before 1.16.2-2.oe1 | 1.16.2-2.oe1 |
gstreamer-plugins-goodSUSE:Linux Enterprise Module for Basesystem 15 SP2 From an advisory covering 2 CVEs |
before 1.16.3-3.6.1 | 1.16.3-3.6.1 |
gstreamer-plugins-goodSUSE:Linux Enterprise Module for Basesystem 15 SP3 From an advisory covering 2 CVEs |
before 1.16.3-3.6.1 | 1.16.3-3.6.1 |
gst-plugins-good1.0Ubuntu:18.04:LTS |
before 1.14.5-0ubuntu1~18.04.2, plus listed versions 1.12.3-1ubuntu11.12.4-1ubuntu11.13.1-1ubuntu11.13.91-1ubuntu11.14.0-1ubuntu11.14.1-1ubuntu1~ubuntu18.04.11.14.4-1ubuntu1~ubuntu18.04.11.14.5-0ubuntu1~18.04.1 |
1.14.5-0ubuntu1~18.04.2 |
gst-plugins-good1.0Ubuntu:20.04:LTS |
before 1.16.2-1ubuntu2.1, plus listed versions 1.16.1-1ubuntu11.16.2-1ubuntu11.16.2-1ubuntu2 |
1.16.2-1ubuntu2.1 |
gst-plugins-good1.0Ubuntu:16.04:LTS From an advisory covering 2 CVEs |
before 1.8.3-1ubuntu0.5, plus listed versions 1.6.0-1ubuntu11.6.1-1ubuntu11.6.2-1ubuntu11.7.1-1ubuntu11.7.2-1ubuntu1 Show 9 moreShow less1.7.90-1ubuntu11.7.91-1ubuntu11.8.0-1ubuntu11.8.1-1ubuntu0.11.8.2-1ubuntu0.11.8.2-1ubuntu0.21.8.2-1ubuntu0.31.8.3-1ubuntu0.31.8.3-1ubuntu0.4 |
1.8.3-1ubuntu0.5 |
gst-plugins-good1.0Ubuntu:18.04:LTS From an advisory covering 2 CVEs |
before 1.14.5-0ubuntu1~18.04.2, plus listed versions 1.12.3-1ubuntu11.12.4-1ubuntu11.13.1-1ubuntu11.13.91-1ubuntu11.14.0-1ubuntu11.14.1-1ubuntu1~ubuntu18.04.11.14.4-1ubuntu1~ubuntu18.04.11.14.5-0ubuntu1~18.04.1 |
1.14.5-0ubuntu1~18.04.2 |
gst-plugins-good1.0Ubuntu:20.04:LTS From an advisory covering 2 CVEs |
before 1.16.2-1ubuntu2.1, plus listed versions 1.16.1-1ubuntu11.16.2-1ubuntu11.16.2-1ubuntu2 |
1.16.2-1ubuntu2.1 |
gstreamer-plugins-goodopenSUSE:Leap 15.2 From an advisory covering 2 CVEs |
before 1.16.3-lp152.2.6.1 | 1.16.3-lp152.2.6.1 |
gstreamer-plugins-goodopenSUSE:Leap 15.3 From an advisory covering 2 CVEs |
before 1.16.3-3.6.1 | 1.16.3-3.6.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-3498 is a high vulnerability (CVSS 7.8) in Gstreamer, published April 19, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.76%, the 78th percentile. Fixed in gst-plugins-good 1.18.4-r0.
References
bugzilla.redhat.com/show_bug.cgi?id=1945342
gstreamer.freedesktop.org/security/sa-2021-0003.html
debian.org/security/2021/dsa-4900
packetstormsecurity.com/files/162952/Gstreamer-Matroska-Demuxing-Use-After-Free.html
security.gentoo.org/glsa/202208-31
nvd.nist.gov/vuln/detail/CVE-2021-3498
Show 19 moreShow less
github.com/advisories/GHSA-hf4m-4x6v-4wvr
security.alpinelinux.org/vuln/CVE-2021-3498
docs.bell-sw.com/security/cves/CVE-2021-3498
security-tracker.debian.org/tracker/CVE-2021-3498
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1322
suse.com/support/update/announcement/2021/suse-su-20212915-1
bugzilla.suse.com/1184735
ubuntu.com/security/CVE-2021-3498
gitlab.freedesktop.org/gstreamer/gst-plugins-good/-/commit/02174790726dd20a5c73ce2002189bf240ad4fe0?merge_request_iid=903
cve.org/CVERecord?id=CVE-2021-3498
lists.opensuse.org/archives/list/[email protected]/thread/GU3E72N7AIZNV6RLT3OM7V74BRCXVX4R