CVE-2026-53704
Gstreamer1-plugins-ugly-free: gstreamer: out-of-bounds read in realmedia demuxer fileinfo metadata parser
A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a RealMedia file containing a specially crafted FILEINFO metadata section, the demuxer parses variable-name and variable-value pairs using re_skip_pascal_string() without validating that offsets remain within the mapped buffer. Additionally, the element count controlling the parsing loop is read from attacker-controlled data without validation, which can cause an infinite loop. A crafted RealMedia file can cause the application to crash, hang, or potentially read limited adjacent memory contents.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Gstreamer1-plugins-ugly-free: gstreamer: out-of-bounds read in realmedia demuxer fileinfo metadata parser
A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a RealMedia file containing a specially crafted FILEINFO metadata section, the demuxer parses variable-name and variable-value pairs using re_skip_pascal_string() without validating that offsets remain within the mapped buffer. Additionally, the element count controlling the parsing loop is read from attacker-controlled data without validation, which can cause an infinite loop. A crafted RealMedia file can cause the application to crash, hang, or potentially read limited adjacent memory contents.
- Record
CVE-2026-53704- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-05
EUVDEUVD-2026-36802
A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a RealMedia file containing a specially crafted FILEINFO metadata section, the demuxer parses variable-name and variable-value pairs using re_skip_pascal_string() without validating that offsets remain within the mapped buffer. Additionally, the element count controlling the parsing loop is read from attacker-controlled data without validation, which can cause an infinite loop. A crafted RealMedia file can cause the application to crash, hang, or potentially read limited adjacent memory contents.
- Record
EUVD-2026-36802- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-j3jj-fwr8-4v9m
A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When...
A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a RealMedia file containing a specially crafted FILEINFO metadata section, the demuxer parses variable-name and variable-value pairs using re_skip_pascal_string() without validating that offsets remain within the mapped buffer. Additionally, the element count controlling the parsing loop is read from attacker-controlled data without validation, which can cause an infinite loop. A crafted RealMedia file can cause the application to crash, hang, or potentially read limited adjacent memory contents.
- Record
GHSA-j3jj-fwr8-4v9m- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a RealMedia file containing a specially crafted FILEINFO metadata section, the demuxer parses variable-name and variable-value pairs using re_skip_pascal_string() without validating that offsets remain within the mapped buffer. Additionally, the element count controlling the parsing loop is read from attacker-controlled data without validation, which can cause an infinite loop. A crafted RealMedia file can cause the application to crash, hang, or potentially read limited adjacent memory contents.
- Record
CVE-2026-53704- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-53704
A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a RealMedia file containing a specially crafted FILEINFO metadata section, the demuxer parses variable-name and variable-value pairs using re_skip_pascal_string() without validating that offsets remain within the mapped buffer. Additionally, the element count controlling the parsing loop is read from attacker-controlled data without validation, which can cause an infinite loop. A crafted RealMedia file can cause the application to crash, hang, or potentially read limited adjacent memory contents.
- Record
DEBIAN-CVE-2026-53704- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-06
OSVRHSA-2026:36673
Red Hat Security Advisory: gstreamer1-plugins-ugly-free security update
- Record
RHSA-2026:36673- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSVRHSA-2026:36674
Red Hat Security Advisory: gstreamer1-plugins-ugly-free security update
- Record
RHSA-2026:36674- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:50688
Red Hat Security Advisory: gstreamer1-plugins-ugly-free security update
- Record
RHSA-2026:50688- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:50691
Red Hat Security Advisory: gstreamer1-plugins-ugly-free security update
- Record
RHSA-2026:50691- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
OSVRLSA-2026:36674
Moderate: gstreamer1-plugins-ugly-free security update
GStreamer is a streaming media framework, based on graphs of elements which operate on media data. This package contains plug-ins whose license is not fully compatible with LGPL.
Security Fix(es):
-
gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header parser (CVE-2026-53703)
-
gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer FILEINFO metadata parser (CVE-2026-53704)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:36674- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-53704
A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a RealMedia file containing a specially crafted FILEINFO metadata section, the demuxer parses variable-name and variable-value pairs using re_skip_pascal_string() without validating that offsets remain within the mapped buffer. Additionally, the element count controlling the parsing loop is read from attacker-controlled data without validation, which can cause an infinite loop. A crafted RealMedia file can cause the application to crash, hang, or potentially read limited adjacent memory contents.
- Record
UBUNTU-CVE-2026-53704- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
OSVALSA-2026:36674 No score
Moderate: gstreamer1-plugins-ugly-free security update
GStreamer is a streaming media framework, based on graphs of elements which operate on media data. This package contains plug-ins whose license is not fully compatible with LGPL.
Security Fix(es):
- gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header parser (CVE-2026-53703)
- gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer FILEINFO metadata parser (CVE-2026-53704)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:36674- Updated
- 2026-11-02
OSVCLSA-2026-1784107571 No score
gstreamer1-plugins-ugly-free: Fix of 2 CVEs
- CVE-2026-53703: fix rmdemux out-of-bounds read parsing MDPR audio header
- CVE-2026-53704: fix rmdemux security issues in FILEINFO/pascal-string parsing
- Record
CLSA-2026-1784107571- Updated
- 2026-11-02
OSVUSN-8896-1 No score
gst-plugins-ugly1.0 vulnerabilities
Michael Randrianantenaina discovered that GStreamer's Ugly Plugins incorrectly handled certain malformed RealMedia files. If a user were tricked into opening a crafted media file, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-38103, CVE-2023-38104)
It was discovered that GStreamer's Ugly Plugins incorrectly handled certain malformed ASF and RealMedia files. If a user were tricked into opening a crafted media file, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-2920, CVE-2026-2922)
Tianshuo Han discovered that GStreamer's Ugly Plugins incorrectly handled certain malformed RealMedia files. If a user were tricked into opening a crafted media file, an attacker could possibly use this issue to cause a denial of service or expose sensitive information. (CVE-2026-53703, CVE-2026-53704)
Seonwook Kim discovered that GStreamer's Ugly Plugins incorrectly handled certain malformed ASF files. If a user were tricked into opening a crafted media file, an attacker could possibly use this issue to cause a denial of service or expose sensitive information. (CVE-2026-19389)
- Record
USN-8896-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gstreamer1-plugins-ugly-freeAlmaLinux:9 From an advisory covering 2 CVEs |
before 1.22.12-6.el9_8.1 | 1.22.12-6.el9_8.1 |
gstreamer1-plugins-ugly-freeTuxCare:AlmaLinux:9.6 From an advisory covering 2 CVEs |
before 1.22.12-3.el9_6.tuxcare.els2 | 1.22.12-3.el9_6.tuxcare.els2 |
gst-plugins-ugly1.0Debian:12 |
All versions, plus listed versions 1.22.0-21.22.0-2+deb12u11.22.0-2+deb12u21.22.1-11.22.10-1 Show 45 moreShow less1.22.3-11.22.3-21.22.4-11.22.5-11.22.6-11.22.7-11.22.8-11.22.9-11.23.1-11.23.2-11.23.90-11.24.0-11.24.1-11.24.10-11.24.11-11.24.12-11.24.2-11.24.3-11.24.4-11.24.5-11.24.6-11.24.7-11.24.8-11.24.9-11.25.1-11.25.50-11.25.50-21.25.90-11.25.90-21.26.0-11.26.1-11.26.10-11.26.2-11.26.3-11.26.3-21.26.3-31.26.3-41.26.4-11.26.5-11.26.5-21.26.6-11.26.7-11.26.8-11.26.9-11.27.1-1 |
None known |
gst-plugins-ugly1.0Debian:13 |
All versions, plus listed versions 1.26.10-11.26.3-41.26.3-4+deb13u11.26.4-11.26.5-1 Show 21 moreShow less1.26.5-21.26.6-11.26.7-11.26.8-11.26.9-11.27.1-11.27.2-11.27.50-11.27.50-21.27.90-11.28.0-11.28.1-11.28.2-11.28.3-11.28.4-11.28.5-11.28.6-11.28.7-11.28.8-11.29.1-11.29.2-1 |
None known |
gst-plugins-ugly1.0Debian:14 |
before 1.28.4-1, plus listed versions 1.26.10-11.26.3-41.26.4-11.26.5-11.26.5-2 Show 13 moreShow less1.26.6-11.26.7-11.26.8-11.26.9-11.27.1-11.27.2-11.27.50-11.27.50-21.27.90-11.28.0-11.28.1-11.28.2-11.28.3-1 |
1.28.4-1 |
gstreamer1-plugins-ugly-freeRed Hat:enterprise_linux:10.2 From an advisory covering 2 CVEs |
before 0:1.26.7-2.el10_2.1 | 0:1.26.7-2.el10_2.1 |
gstreamer1-plugins-ugly-free-debuginfoRed Hat:enterprise_linux:10.2 From an advisory covering 2 CVEs |
before 0:1.26.7-2.el10_2.1 | 0:1.26.7-2.el10_2.1 |
gstreamer1-plugins-ugly-free-debugsourceRed Hat:enterprise_linux:10.2 From an advisory covering 2 CVEs |
before 0:1.26.7-2.el10_2.1 | 0:1.26.7-2.el10_2.1 |
gstreamer1-plugins-ugly-freeRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.22.12-6.el9_8.1 | 0:1.22.12-6.el9_8.1 |
gstreamer1-plugins-ugly-free-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.22.12-6.el9_8.1 | 0:1.22.12-6.el9_8.1 |
Show 21 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gstreamer1-plugins-ugly-free-debugsourceRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.22.12-6.el9_8.1 | 0:1.22.12-6.el9_8.1 |
gstreamer1-plugins-ugly-freeRed Hat:enterprise_linux_eus:10.0 From an advisory covering 2 CVEs |
before 0:1.24.11-1.el10_0.2 | 0:1.24.11-1.el10_0.2 |
gstreamer1-plugins-ugly-free-debuginfoRed Hat:enterprise_linux_eus:10.0 From an advisory covering 2 CVEs |
before 0:1.24.11-1.el10_0.2 | 0:1.24.11-1.el10_0.2 |
gstreamer1-plugins-ugly-free-debugsourceRed Hat:enterprise_linux_eus:10.0 From an advisory covering 2 CVEs |
before 0:1.24.11-1.el10_0.2 | 0:1.24.11-1.el10_0.2 |
gstreamer1-plugins-ugly-freeRed Hat:rhel_eus:9.6::appstream From an advisory covering 2 CVEs |
before 0:1.22.12-4.el9_6.1 | 0:1.22.12-4.el9_6.1 |
gstreamer1-plugins-ugly-free-debuginfoRed Hat:rhel_eus:9.6::appstream From an advisory covering 2 CVEs |
before 0:1.22.12-4.el9_6.1 | 0:1.22.12-4.el9_6.1 |
gstreamer1-plugins-ugly-free-debugsourceRed Hat:rhel_eus:9.6::appstream From an advisory covering 2 CVEs |
before 0:1.22.12-4.el9_6.1 | 0:1.22.12-4.el9_6.1 |
gstreamer1-plugins-ugly-freeRocky Linux:9 From an advisory covering 2 CVEs |
before 0:1.22.12-6.el9_8.1 | 0:1.22.12-6.el9_8.1 |
gst-plugins-ugly1.0Ubuntu:Pro:16.04:LTS |
before 1.8.3-1ubuntu0.1+esm2, plus listed versions 1.6.0-1ubuntu11.6.1-1ubuntu11.6.2-1ubuntu11.7.1-1ubuntu11.7.2-1ubuntu1 Show 7 moreShow less1.7.90-1ubuntu11.7.91-1ubuntu11.8.0-1ubuntu11.8.1-1ubuntu0.11.8.2-1ubuntu0.11.8.3-1ubuntu0.11.8.3-1ubuntu0.1+esm1 |
1.8.3-1ubuntu0.1+esm2 |
gst-plugins-ugly1.0Ubuntu:Pro:18.04:LTS |
before 1.14.5-0ubuntu1~18.04.1+esm1, plus listed versions 1.12.3-11.12.3-1build11.12.4-11.12.4-1build11.13.1-1 Show 5 moreShow less1.13.91-11.14.0-11.14.1-1~ubuntu18.04.11.14.4-1~ubuntu18.04.11.14.5-0ubuntu1~18.04.1 |
1.14.5-0ubuntu1~18.04.1+esm1 |
gst-plugins-ugly1.0Ubuntu:Pro:20.04:LTS |
before 1.16.2-2ubuntu0.1~esm1, plus listed versions 1.16.1-11.16.1-1build11.16.2-11.16.2-21.16.2-2build1 |
1.16.2-2ubuntu0.1~esm1 |
gst-plugins-ugly1.0Ubuntu:Pro:22.04:LTS |
before 1.20.1-1ubuntu0.1~esm1, plus listed versions 1.18.5-11.20.0-11.20.0-1build11.20.1-1 |
1.20.1-1ubuntu0.1~esm1 |
gst-plugins-ugly1.0Ubuntu:Pro:24.04:LTS |
before 1.24.1-1ubuntu0.1~esm1, plus listed versions 1.22.5-11.22.6-11.22.7-11.22.8-11.22.10-11.24.1-11.24.1-1build1 |
1.24.1-1ubuntu0.1~esm1 |
gst-plugins-ugly1.0Ubuntu:25.10 |
All versions, plus listed versions 1.26.0-11.26.1-11.26.2-11.26.3-11.26.3-3 Show 4 moreShow less1.26.3-41.26.4-11.26.5-11.26.6-1 |
None known |
gst-plugins-ugly1.0Ubuntu:Pro:26.04:LTS |
before 1.28.2-1ubuntu0.1~esm1, plus listed versions 1.26.6-11.26.7-1build11.27.2-11.27.90-11.28.0-11.28.1-11.28.2-1 |
1.28.2-1ubuntu0.1~esm1 |
gst-plugins-ugly1.0Ubuntu:Pro:16.04:LTS From an advisory covering 7 CVEs |
before 1.8.3-1ubuntu0.1+esm2, plus listed versions 1.6.0-1ubuntu11.6.1-1ubuntu11.6.2-1ubuntu11.7.1-1ubuntu11.7.2-1ubuntu1 Show 7 moreShow less1.7.90-1ubuntu11.7.91-1ubuntu11.8.0-1ubuntu11.8.1-1ubuntu0.11.8.2-1ubuntu0.11.8.3-1ubuntu0.11.8.3-1ubuntu0.1+esm1 |
1.8.3-1ubuntu0.1+esm2 |
gst-plugins-ugly1.0Ubuntu:Pro:18.04:LTS From an advisory covering 7 CVEs |
before 1.14.5-0ubuntu1~18.04.1+esm1, plus listed versions 1.12.3-11.12.3-1build11.12.4-11.12.4-1build11.13.1-1 Show 5 moreShow less1.13.91-11.14.0-11.14.1-1~ubuntu18.04.11.14.4-1~ubuntu18.04.11.14.5-0ubuntu1~18.04.1 |
1.14.5-0ubuntu1~18.04.1+esm1 |
gst-plugins-ugly1.0Ubuntu:Pro:20.04:LTS From an advisory covering 7 CVEs |
before 1.16.2-2ubuntu0.1~esm1, plus listed versions 1.16.1-11.16.1-1build11.16.2-11.16.2-21.16.2-2build1 |
1.16.2-2ubuntu0.1~esm1 |
gst-plugins-ugly1.0Ubuntu:Pro:22.04:LTS From an advisory covering 7 CVEs |
before 1.20.1-1ubuntu0.1~esm1, plus listed versions 1.18.5-11.20.0-11.20.0-1build11.20.1-1 |
1.20.1-1ubuntu0.1~esm1 |
gst-plugins-ugly1.0Ubuntu:Pro:24.04:LTS From an advisory covering 7 CVEs |
before 1.24.1-1ubuntu0.1~esm1, plus listed versions 1.22.5-11.22.6-11.22.7-11.22.8-11.22.10-11.24.1-11.24.1-1build1 |
1.24.1-1ubuntu0.1~esm1 |
gst-plugins-ugly1.0Ubuntu:Pro:26.04:LTS From an advisory covering 7 CVEs |
before 1.28.2-1ubuntu0.1~esm1, plus listed versions 1.26.6-11.26.7-1build11.27.2-11.27.90-11.28.0-11.28.1-11.28.2-1 |
1.28.2-1ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected | EUVD, NVD | |
| facts | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-53704 is a high vulnerability (CVSS 7.1) in Red Hat Enterprise Linux 10, published June 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. Fixed in gst-plugins-ugly1.0 1.28.4-1.
References
access.redhat.com/errata/RHSA-2026:36673
bugzilla.redhat.com/show_bug.cgi?id=2487614
Show 31 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-53704
github.com/advisories/GHSA-j3jj-fwr8-4v9m
errata.almalinux.org/9/ALSA-2026-36674.html
errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1784107571.html
security-tracker.debian.org/tracker/CVE-2026-53704
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36673.json
cve.org/CVERecord?id=CVE-2026-53703
errata.rockylinux.org/RLSA-2026:36674
ubuntu.com/security/CVE-2026-53704
gstreamer.freedesktop.org/security/sa-2026-0042.html
gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11825
Left out here: 15 versions. The JSON record has them.