CVE-2026-18298

GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.

Security Fix(es):

GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of MRF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29510.(CVE-2026-18295)

GStreamer MRF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of MRF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29608.(CVE-2026-18296)

GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PNG files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29581.(CVE-2026-18298)

GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the processing of RTP payload elements. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29787.(CVE-2026-18299)

GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.

Security Fix(es):

GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of MRF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29510.(CVE-2026-18295)

GStreamer MRF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of MRF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29608.(CVE-2026-18296)

GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PNG files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29581.(CVE-2026-18298)

GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the processing of RTP payload elements. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29787.(CVE-2026-18299)

GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.

Security Fix(es):

GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of MRF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29510.(CVE-2026-18295)

GStreamer MRF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of MRF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29608.(CVE-2026-18296)

GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PNG files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29581.(CVE-2026-18298)

GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the processing of RTP payload elements. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29787.(CVE-2026-18299)

GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.

Security Fix(es):

GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of MRF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29510.(CVE-2026-18295)

GStreamer MRF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of MRF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29608.(CVE-2026-18296)

GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PNG files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29581.(CVE-2026-18298)

GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the processing of RTP payload elements. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29787.(CVE-2026-18299)

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.

Security Fix(es):

• gstreamer: GStreamer: Remote Code Execution via MRF file parsing heap-based buffer overflow (CVE-2026-18296)

• gstreamer: GStreamer: Remote code execution via heap-based buffer overflow in PNG file parsing (CVE-2026-18298)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.

Security Fix(es):

• gstreamer: GStreamer: Remote Code Execution via MRF file parsing heap-based buffer overflow (CVE-2026-18296)

• gstreamer: GStreamer: Remote code execution via heap-based buffer overflow in PNG file parsing (CVE-2026-18298)

• gstreamer: GStreamer: Remote Code Execution via Use-After-Free in rtpsbcdepay (CVE-2026-18299)

• GStreamer: GStreamer: Remote code execution via MRF file parsing (CVE-2026-18295)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.

Security Fix(es):

• gstreamer: GStreamer: Remote Code Execution via MRF file parsing heap-based buffer overflow (CVE-2026-18296)

• gstreamer: GStreamer: Remote code execution via heap-based buffer overflow in PNG file parsing (CVE-2026-18298)

• gstreamer: GStreamer: Remote Code Execution via Use-After-Free in rtpsbcdepay (CVE-2026-18299)

• GStreamer: GStreamer: Remote code execution via MRF file parsing (CVE-2026-18295)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PNG files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29581.

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.

Security Fix(es):

• gstreamer: GStreamer: Remote Code Execution via MRF file parsing heap-based buffer overflow (CVE-2026-18296)
• gstreamer: GStreamer: Remote code execution via heap-based buffer overflow in PNG file parsing (CVE-2026-18298)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.

Security Fix(es):

• gstreamer: GStreamer: Remote Code Execution via MRF file parsing heap-based buffer overflow (CVE-2026-18296)
• gstreamer: GStreamer: Remote code execution via heap-based buffer overflow in PNG file parsing (CVE-2026-18298)
• gstreamer: GStreamer: Remote Code Execution via Use-After-Free in rtpsbcdepay (CVE-2026-18299)
• GStreamer: GStreamer: Remote code execution via MRF file parsing (CVE-2026-18295)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.

Security Fix(es):

• gstreamer: GStreamer: Remote Code Execution via MRF file parsing heap-based buffer overflow (CVE-2026-18296)
• gstreamer: GStreamer: Remote code execution via heap-based buffer overflow in PNG file parsing (CVE-2026-18298)
• gstreamer: GStreamer: Remote Code Execution via Use-After-Free in rtpsbcdepay (CVE-2026-18299)
• GStreamer: GStreamer: Remote code execution via MRF file parsing (CVE-2026-18295)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2026-18295: qtmoovrecover: validate box sizes when parsing MRF recovery files to prevent an out-of-bounds write
• CVE-2026-18296: qtmoovrecover: validate minimum atom sizes when parsing MRF recovery files to prevent a heap buffer overflow
• CVE-2026-18298: gdkpixbufdec: handle format and resolution changes correctly to prevent a heap buffer overflow
• CVE-2026-18299: rtpsbcdepay: check for available data in the adapter and for a large enough payload header to prevent an out-of-bounds read and use-after-free

• CVE-2026-18295: fix out-of-bounds write in MRF atoms recovery parsing that could lead to remote code execution
• CVE-2026-18296: fix heap-based buffer overflow in MRF atoms recovery parsing that could lead to remote code execution
• CVE-2026-18298: drop gdkpixbufdec rank to NONE and fix output buffer pool not being reconfigured on format/resolution changes between frames
• CVE-2026-18299: fix use-after-free in rtpsbcdepay RTP payload processing
• CVE-2026-73433: fix integer underflow in avidemux FUJIFILM strd metadata parsing that could cause an out-of-bounds read/write
• CVE-2026-73434: fix out-of-bounds read in avidemux vprp video field descriptor parsing caused by an incorrect divisor

• rebase onto Oracle 1.10.4-2.0.7.el7_9
• the vendor fixes in this build: CVE-2026-18295 and CVE-2026-18296 (qtmoovrecover: validate box sizes), CVE-2026-18298 (gdkpixbufdec: handle format and resolution changes correctly) and CVE-2026-18299 (rtpsbcdepay: check that enough data is available in the adapter)
• keep the TuxCare wavpackdec follow-up to the vendor's Patch1007: it widens the output-buffer size computation in gst_wavpack_dec_handle_frame() to gsize, which the vendor's backport leaves in 32-bit arithmetic on this branch
• keep the matroska-demux.c correction that restores the 18-byte WAVEFORMATEX offset dropped by the vendor's Patch1003 in its pre-2.67.4 glib port
• keep the gtk-doc build fix and BuildRequires: gtk-doc unbounded rather than Oracle's <= 1.25.1, which no i686 buildroot can satisfy
• renumber the two TuxCare follow-up patches to Patch1011 and Patch1012; Oracle took 1008 and 1009 for its own patches in this build
• keep the CVE-2026-73433 and CVE-2026-73434 avidemux fixes from 1.10.4-2.0.5.tuxcare.els2, renumbered to Patch1013 and Patch1014 since Oracle took 1010 in this build

• rebase onto Oracle 1.10.4-2.0.7.el7_9
• the vendor fixes in this build: CVE-2026-18295 and CVE-2026-18296 (qtmoovrecover: validate box sizes), CVE-2026-18298 (gdkpixbufdec: handle format and resolution changes correctly) and CVE-2026-18299 (rtpsbcdepay: check that enough data is available in the adapter)
• keep the TuxCare wavpackdec follow-up to the vendor's Patch1007: it widens the output-buffer size computation in gst_wavpack_dec_handle_frame() to gsize, which the vendor's backport leaves in 32-bit arithmetic on this branch
• keep the matroska-demux.c correction that restores the 18-byte WAVEFORMATEX offset dropped by the vendor's Patch1003 in its pre-2.67.4 glib port
• keep the gtk-doc build fix and BuildRequires: gtk-doc unbounded rather than Oracle's <= 1.25.1, which no i686 buildroot can satisfy
• renumber the two TuxCare follow-up patches to Patch1011 and Patch1012; Oracle took 1008 and 1009 for its own patches in this build
• keep the CVE-2026-73433 and CVE-2026-73434 avidemux fixes from 1.10.4-2.0.5.tuxcare.els2, renumbered to Patch1013 and Patch1014 since Oracle took 1010 in this build

• rebase onto Oracle 1.10.4-2.0.7.el7_9
• the vendor fixes in this build: CVE-2026-18295 and CVE-2026-18296 (qtmoovrecover: validate box sizes), CVE-2026-18298 (gdkpixbufdec: handle format and resolution changes correctly) and CVE-2026-18299 (rtpsbcdepay: check that enough data is available in the adapter)
• keep the TuxCare wavpackdec follow-up to the vendor's Patch1007: it widens the output-buffer size computation in gst_wavpack_dec_handle_frame() to gsize, which the vendor's backport leaves in 32-bit arithmetic on this branch
• keep the matroska-demux.c correction that restores the 18-byte WAVEFORMATEX offset dropped by the vendor's Patch1003 in its pre-2.67.4 glib port
• keep the gtk-doc build fix and BuildRequires: gtk-doc unbounded rather than Oracle's <= 1.25.1, which no i686 buildroot can satisfy
• renumber the two TuxCare follow-up patches to Patch1011 and Patch1012; Oracle took 1008 and 1009 for its own patches in this build
• keep the CVE-2026-73433 and CVE-2026-73434 avidemux fixes from 1.10.4-2.0.5.tuxcare.els2, renumbered to Patch1013 and Patch1014 since Oracle took 1010 in this build

Root has patched CVE-2026-18298 in the gst-plugins-good1.0 package for Root:Debian:13. Multiple fixed versions available.

It was discovered that GStreamer Good Plugins incorrectly parsed certain MRF files. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-18295, CVE-2026-18296)

It was discovered that GStreamer Good Plugins incorrectly parsed certain PNG files. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-18298)

DongHyeon Hwang discovered that GStreamer Good Plugins incorrectly handled certain RTP packets. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-18299)