{"id":"CVE-2026-53703","aliases":["ALSA-2026:36673","ALSA-2026:36674","CLSA-2026-1784107571","DEBIAN-CVE-2026-53703","EUVD-2026-36801","GHSA-hghw-p2mw-fvch","RHSA-2026:36673","RHSA-2026:36674","RHSA-2026:50688","RHSA-2026:50691","RLSA-2026:36673","RLSA-2026:36674","UBUNTU-CVE-2026-53703","USN-8896-1"],"status":"published","title":"Gstreamer1-plugins-ugly-free: gstreamer: out-of-bounds read in realmedia demuxer audio stream header parser","description":"A vulnerability was found in the GStreamer RealMedia demuxer (gst-plugins-ugly). When processing a RealMedia (.rm) file, the demuxer parses MDPR (media properties) chunks to configure audio streams. For audio stream header versions 4 and 5, the parser reads fields such as codec type, packet size, sample rate, channel count, and extra codec data length from fixed offsets within the chunk without first checking that the chunk contains enough data. If a malicious file provides an MDPR chunk that is too small to contain a complete audio stream header, the parser reads beyond the end of the buffer. This can cause the application to crash. In some cases, bytes read past the buffer boundary may be incorporated into stream metadata, which could result in limited information disclosure.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00245,"percentile":0.15765,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-06-15T19:10:30Z","modified":"2026-11-06T12:00:02Z","fixes":[{"ecosystem":"AlmaLinux:10","package":"gstreamer1-plugins-ugly-free","fixed_in":["1.26.7-2.el10_2.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gst-plugins-ugly1.0","fixed_in":["1.28.4-1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"gstreamer1-plugins-ugly-free","fixed_in":["0:1.26.7-2.el10_2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gst-plugins-ugly1.0","fixed_in":["1.8.3-1ubuntu0.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gst-plugins-ugly1.0","fixed_in":["1.14.5-0ubuntu1~18.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gst-plugins-ugly1.0","fixed_in":["1.16.2-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"gst-plugins-ugly1.0","fixed_in":["1.20.1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"gst-plugins-ugly1.0","fixed_in":["1.24.1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:26.04:LTS","package":"gst-plugins-ugly1.0","fixed_in":["1.28.2-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"gstreamer1-plugins-ugly-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-2.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gstreamer1-plugins-ugly-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-6.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gstreamer1-plugins-ugly-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-3.el9_6.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"gst-plugins-ugly1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.0-2","1.22.0-2+deb12u1","1.22.0-2+deb12u2","1.22.1-1","1.22.10-1","1.22.3-1","1.22.3-2","1.22.4-1","1.22.5-1","1.22.6-1","1.22.7-1","1.22.8-1","1.22.9-1","1.23.1-1","1.23.2-1","1.23.90-1","1.24.0-1","1.24.1-1","1.24.10-1","1.24.11-1","1.24.12-1","1.24.2-1","1.24.3-1","1.24.4-1","1.24.5-1","1.24.6-1","1.24.7-1","1.24.8-1","1.24.9-1","1.25.1-1","1.25.50-1","1.25.50-2","1.25.90-1","1.25.90-2","1.26.0-1","1.26.1-1","1.26.10-1","1.26.2-1","1.26.3-1","1.26.3-2","1.26.3-3","1.26.3-4","1.26.4-1","1.26.5-1","1.26.5-2","1.26.6-1","1.26.7-1","1.26.8-1","1.26.9-1","1.27.1-1","1.27.2-1","1.27.50-1","1.27.50-2","1.27.90-1","1.28.0-1","1.28.1-1","1.28.2-1","1.28.3-1","1.28.4-1","1.28.5-1","1.28.6-1","1.28.7-1","1.28.8-1","1.29.1-1","1.29.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"gst-plugins-ugly1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.10-1","1.26.3-4","1.26.3-4+deb13u1","1.26.4-1","1.26.5-1","1.26.5-2","1.26.6-1","1.26.7-1","1.26.8-1","1.26.9-1","1.27.1-1","1.27.2-1","1.27.50-1","1.27.50-2","1.27.90-1","1.28.0-1","1.28.1-1","1.28.2-1","1.28.3-1","1.28.4-1","1.28.5-1","1.28.6-1","1.28.7-1","1.28.8-1","1.29.1-1","1.29.2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"gst-plugins-ugly1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.4-1"}]}],"versions":["1.26.10-1","1.26.3-4","1.26.4-1","1.26.5-1","1.26.5-2","1.26.6-1","1.26.7-1","1.26.8-1","1.26.9-1","1.27.1-1","1.27.2-1","1.27.50-1","1.27.50-2","1.27.90-1","1.28.0-1","1.28.1-1","1.28.2-1","1.28.3-1"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"gstreamer1-plugins-ugly-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.7-2.el10_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"gstreamer1-plugins-ugly-free-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.7-2.el10_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"gstreamer1-plugins-ugly-free-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.7-2.el10_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-ugly-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-6.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-ugly-free-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-6.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-ugly-free-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-6.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gstreamer1-plugins-ugly-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.11-1.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gstreamer1-plugins-ugly-free-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.11-1.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gstreamer1-plugins-ugly-free-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.11-1.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gstreamer1-plugins-ugly-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-4.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gstreamer1-plugins-ugly-free-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-4.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gstreamer1-plugins-ugly-free-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-4.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"gstreamer1-plugins-ugly-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.7-2.el10_2.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"gstreamer1-plugins-ugly-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-6.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gst-plugins-ugly1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1ubuntu0.1+esm2"}]}],"versions":["1.6.0-1ubuntu1","1.6.1-1ubuntu1","1.6.2-1ubuntu1","1.7.1-1ubuntu1","1.7.2-1ubuntu1","1.7.90-1ubuntu1","1.7.91-1ubuntu1","1.8.0-1ubuntu1","1.8.1-1ubuntu0.1","1.8.2-1ubuntu0.1","1.8.3-1ubuntu0.1","1.8.3-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gst-plugins-ugly1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.5-0ubuntu1~18.04.1+esm1"}]}],"versions":["1.12.3-1","1.12.3-1build1","1.12.4-1","1.12.4-1build1","1.13.1-1","1.13.91-1","1.14.0-1","1.14.1-1~ubuntu18.04.1","1.14.4-1~ubuntu18.04.1","1.14.5-0ubuntu1~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gst-plugins-ugly1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-2ubuntu0.1~esm1"}]}],"versions":["1.16.1-1","1.16.1-1build1","1.16.2-1","1.16.2-2","1.16.2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"gst-plugins-ugly1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-1ubuntu0.1~esm1"}]}],"versions":["1.18.5-1","1.20.0-1","1.20.0-1build1","1.20.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"gst-plugins-ugly1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.1-1ubuntu0.1~esm1"}]}],"versions":["1.22.5-1","1.22.6-1","1.22.7-1","1.22.8-1","1.22.10-1","1.24.1-1","1.24.1-1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"gst-plugins-ugly1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.0-1","1.26.1-1","1.26.2-1","1.26.3-1","1.26.3-3","1.26.3-4","1.26.4-1","1.26.5-1","1.26.6-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"gst-plugins-ugly1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2-1ubuntu0.1~esm1"}]}],"versions":["1.26.6-1","1.26.7-1build1","1.27.2-1","1.27.90-1","1.28.0-1","1.28.1-1","1.28.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gst-plugins-ugly1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1ubuntu0.1+esm2"}]}],"versions":["1.6.0-1ubuntu1","1.6.1-1ubuntu1","1.6.2-1ubuntu1","1.7.1-1ubuntu1","1.7.2-1ubuntu1","1.7.90-1ubuntu1","1.7.91-1ubuntu1","1.8.0-1ubuntu1","1.8.1-1ubuntu0.1","1.8.2-1ubuntu0.1","1.8.3-1ubuntu0.1","1.8.3-1ubuntu0.1+esm1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gst-plugins-ugly1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.5-0ubuntu1~18.04.1+esm1"}]}],"versions":["1.12.3-1","1.12.3-1build1","1.12.4-1","1.12.4-1build1","1.13.1-1","1.13.91-1","1.14.0-1","1.14.1-1~ubuntu18.04.1","1.14.4-1~ubuntu18.04.1","1.14.5-0ubuntu1~18.04.1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gst-plugins-ugly1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-2ubuntu0.1~esm1"}]}],"versions":["1.16.1-1","1.16.1-1build1","1.16.2-1","1.16.2-2","1.16.2-2build1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"gst-plugins-ugly1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-1ubuntu0.1~esm1"}]}],"versions":["1.18.5-1","1.20.0-1","1.20.0-1build1","1.20.1-1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"gst-plugins-ugly1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.1-1ubuntu0.1~esm1"}]}],"versions":["1.22.5-1","1.22.6-1","1.22.7-1","1.22.8-1","1.22.10-1","1.24.1-1","1.24.1-1build1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"gst-plugins-ugly1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2-1ubuntu0.1~esm1"}]}],"versions":["1.26.6-1","1.26.7-1build1","1.27.2-1","1.27.90-1","1.28.0-1","1.28.1-1","1.28.2-1"],"bundled":7}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.0 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.6 extended update support"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:36673","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36674","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50688","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50691","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53703","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487613","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53703","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hghw-p2mw-fvch"},{"url":"https://bugzilla.redhat.com/2487613","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-36673.html","tags":["advisory"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-53704.html","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53704","tags":["report"]},{"url":"https://bugzilla.redhat.com/2487614","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-36674.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1784107571.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53704","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-53703","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36673.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53703","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487614","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53704","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36674.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50688.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50691.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:36673","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:36674","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-53703","tags":["report"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2026-0042.html","tags":["report"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11825","tags":["report"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11826","tags":["report"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11831","tags":["report"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11832","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8896-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-38103","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-38104","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-2920","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-2922","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-19389","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53704","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-53703","title":"Gstreamer1-plugins-ugly-free: gstreamer: out-of-bounds read in realmedia demuxer audio stream header parser","description":"A vulnerability was found in the GStreamer RealMedia demuxer (gst-plugins-ugly). When processing a RealMedia (.rm) file, the demuxer parses MDPR (media properties) chunks to configure audio streams. For audio stream header versions 4 and 5, the parser reads fields such as codec type, packet size, sample rate, channel count, and extra codec data length from fixed offsets within the chunk without first checking that the chunk contains enough data. If a malicious file provides an MDPR chunk that is too small to contain a complete audio stream header, the parser reads beyond the end of the buffer. This can cause the application to crash. In some cases, bytes read past the buffer boundary may be incorporated into stream metadata, which could result in limited information disclosure.","status":"published","published":"2026-06-15T19:10:30.667Z","modified":"2026-11-05T21:43:19.592Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-05T22:55:20.139479Z"}],"euvd":[{"id":"EUVD-2026-36801","description":"A vulnerability was found in the GStreamer RealMedia demuxer (gst-plugins-ugly). When processing a RealMedia (.rm) file, the demuxer parses MDPR (media properties) chunks to configure audio streams. For audio stream header versions 4 and 5, the parser reads fields such as codec type, packet size, sample rate, channel count, and extra codec data length from fixed offsets within the chunk without first checking that the chunk contains enough data. If a malicious file provides an MDPR chunk that is too small to contain a complete audio stream header, the parser reads beyond the end of the buffer. This can cause the application to crash. In some cases, bytes read past the buffer boundary may be incorporated into stream metadata, which could result in limited information disclosure.","status":"published","published":"2026-06-15T19:10:30Z","modified":"2026-11-05T21:43:19Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T23:02:20.394374Z"}],"ghsa":[{"id":"GHSA-hghw-p2mw-fvch","title":"A vulnerability was found in the GStreamer RealMedia demuxer (gst-plugins-ugly). When processing...","description":"A vulnerability was found in the GStreamer RealMedia demuxer (gst-plugins-ugly). When processing a RealMedia (.rm) file, the demuxer parses MDPR (media properties) chunks to configure audio streams. For audio stream header versions 4 and 5, the parser reads fields such as codec type, packet size, sample rate, channel count, and extra codec data length from fixed offsets within the chunk without first checking that the chunk contains enough data. If a malicious file provides an MDPR chunk that is too small to contain a complete audio stream header, the parser reads beyond the end of the buffer. This can cause the application to crash. In some cases, bytes read past the buffer boundary may be incorporated into stream metadata, which could result in limited information disclosure.","status":"published","published":"2026-06-15T21:30:42Z","modified":"2026-08-05T09:32:21Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:10:06.632203Z"}],"nvd":[{"id":"CVE-2026-53703","description":"A vulnerability was found in the GStreamer RealMedia demuxer (gst-plugins-ugly). When processing a RealMedia (.rm) file, the demuxer parses MDPR (media properties) chunks to configure audio streams. For audio stream header versions 4 and 5, the parser reads fields such as codec type, packet size, sample rate, channel count, and extra codec data length from fixed offsets within the chunk without first checking that the chunk contains enough data. If a malicious file provides an MDPR chunk that is too small to contain a complete audio stream header, the parser reads beyond the end of the buffer. This can cause the application to crash. In some cases, bytes read past the buffer boundary may be incorporated into stream metadata, which could result in limited information disclosure.","status":"published","published":"2026-06-15T20:16:33.563Z","modified":"2026-11-05T22:18:47.667Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-05T23:57:19.370761Z"}],"osv":[{"id":"DEBIAN-CVE-2026-53703","description":"A vulnerability was found in the GStreamer RealMedia demuxer (gst-plugins-ugly). When processing a RealMedia (.rm) file, the demuxer parses MDPR (media properties) chunks to configure audio streams. For audio stream header versions 4 and 5, the parser reads fields such as codec type, packet size, sample rate, channel count, and extra codec data length from fixed offsets within the chunk without first checking that the chunk contains enough data. If a malicious file provides an MDPR chunk that is too small to contain a complete audio stream header, the parser reads beyond the end of the buffer. This can cause the application to crash. In some cases, bytes read past the buffer boundary may be incorporated into stream metadata, which could result in limited information disclosure.","status":"published","published":"2026-06-15T20:16:33.563Z","modified":"2026-11-06T10:04:41.094555641Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-06T10:38:22.758306Z"},{"id":"RHSA-2026:36673","title":"Red Hat Security Advisory: gstreamer1-plugins-ugly-free security update","status":"published","published":"2026-07-09T10:12:43Z","modified":"2026-09-09T10:42:40.782622626Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:36674","title":"Red Hat Security Advisory: gstreamer1-plugins-ugly-free security update","status":"published","published":"2026-07-09T10:12:44Z","modified":"2026-09-09T10:13:39Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:50688","title":"Red Hat Security Advisory: gstreamer1-plugins-ugly-free security update","status":"published","published":"2026-08-05T10:37:43Z","modified":"2026-09-09T10:16:45Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:50691","title":"Red Hat Security Advisory: gstreamer1-plugins-ugly-free security update","status":"published","published":"2026-08-05T10:37:44Z","modified":"2026-09-09T10:16:45Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RLSA-2026:36673","title":"Moderate: gstreamer1-plugins-ugly-free security update","description":"GStreamer is a streaming media framework, based on graphs of elements which operate on media data.  This package contains plug-ins whose license is not fully compatible with LGPL.\n\nSecurity Fix(es):\n\n* gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header parser (CVE-2026-53703)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-10T12:05:34.876921Z","modified":"2026-07-10T12:30:04.638193219Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:36674","title":"Moderate: gstreamer1-plugins-ugly-free security update","description":"GStreamer is a streaming media framework, based on graphs of elements which operate on media data.  This package contains plug-ins whose license is not fully compatible with LGPL.\n\nSecurity Fix(es):\n\n* gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header parser (CVE-2026-53703)\n\n* gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer FILEINFO metadata parser (CVE-2026-53704)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-10T12:03:38.827258Z","modified":"2026-07-10T12:30:06.06649376Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"UBUNTU-CVE-2026-53703","description":"A vulnerability was found in the GStreamer RealMedia demuxer (gst-plugins-ugly). When processing a RealMedia (.rm) file, the demuxer parses MDPR (media properties) chunks to configure audio streams. For audio stream header versions 4 and 5, the parser reads fields such as codec type, packet size, sample rate, channel count, and extra codec data length from fixed offsets within the chunk without first checking that the chunk contains enough data. If a malicious file provides an MDPR chunk that is too small to contain a complete audio stream header, the parser reads beyond the end of the buffer. This can cause the application to crash. In some cases, bytes read past the buffer boundary may be incorporated into stream metadata, which could result in limited information disclosure.","status":"published","published":"2026-06-15T20:16:00Z","modified":"2026-10-08T19:48:31.037192148Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"ALSA-2026:36673","title":"Moderate: gstreamer1-plugins-ugly-free security update","description":"GStreamer is a streaming media framework, based on graphs of elements which operate on media data. This package contains plug-ins whose license is not fully compatible with LGPL.  \n\nSecurity Fix(es):  \n\n  * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header parser (CVE-2026-53703)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-08T00:00:00Z","modified":"2026-11-06T12:00:02.705509768Z","updated_at":"2026-11-06T12:12:56.168821Z"},{"id":"ALSA-2026:36674","title":"Moderate: gstreamer1-plugins-ugly-free security update","description":"GStreamer is a streaming media framework, based on graphs of elements which operate on media data. This package contains plug-ins whose license is not fully compatible with LGPL.  \n\nSecurity Fix(es):  \n\n  * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header parser (CVE-2026-53703)\n  * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer FILEINFO metadata parser (CVE-2026-53704)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-08T00:00:00Z","modified":"2026-10-29T11:32:35.0799264Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"CLSA-2026-1784107571","title":"gstreamer1-plugins-ugly-free: Fix of 2 CVEs","description":"- CVE-2026-53703: fix rmdemux out-of-bounds read parsing MDPR audio header\n- CVE-2026-53704: fix rmdemux security issues in FILEINFO/pascal-string parsing","status":"published","published":"2026-07-15T09:26:24Z","modified":"2026-10-26T09:31:16.780133585Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"USN-8896-1","title":"gst-plugins-ugly1.0 vulnerabilities","description":"Michael Randrianantenaina discovered that GStreamer's Ugly Plugins\nincorrectly handled certain malformed RealMedia files. If a user were\ntricked into opening a crafted media file, an attacker could possibly use\nthis issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS,\nUbuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-38103,\nCVE-2023-38104)\n\nIt was discovered that GStreamer's Ugly Plugins incorrectly handled certain\nmalformed ASF and RealMedia files. If a user were tricked into opening a\ncrafted media file, an attacker could possibly use this issue to execute\narbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS and Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-2920,\nCVE-2026-2922)\n\nTianshuo Han discovered that GStreamer's Ugly Plugins incorrectly handled\ncertain malformed RealMedia files. If a user were tricked into opening a\ncrafted media file, an attacker could possibly use this issue to cause a\ndenial of service or expose sensitive information. (CVE-2026-53703,\nCVE-2026-53704)\n\nSeonwook Kim discovered that GStreamer's Ugly Plugins incorrectly handled\ncertain malformed ASF files. If a user were tricked into opening a crafted\nmedia file, an attacker could possibly use this issue to cause a denial of\nservice or expose sensitive information. (CVE-2026-19389)","status":"published","published":"2026-10-07T19:43:55Z","modified":"2026-10-08T19:58:54.749655728Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}