CVE-2026-3086
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A vulnerability in the H.266 codec parser of GStreamer allows remote code execution via an out-of-bounds write. The issue occurs during APS unit processing due to missing user-supplied data validation.
Risk Assessment
An attacker can remotely execute arbitrary code in the context of the process using the GStreamer library, leading to full system or application compromise.
Recommendation
Update GStreamer immediately to a version containing the fix for CVE-2026-3086. Until then, restrict processing of untrusted H.266 streams.
Other vulnerabilities in GStreamer
See all- CVE-2026-17072Low
In GStreamer's gst-plugins-good, a heap-based out-of-bounds read of 4 bytes occurs when parsing FLAC audio stream headers embedded in Matroska or WebM container files. A boundary check does not account for the full size of the copied data, allowing a small read past the end of the allocated buffer. An attacker can exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it.
- CVE-2017-5843High
Multiple use-after-free vulnerabilities in the gst_mini_object_unref, gst_tag_list_unref, and gst_mxf_demux_update_essence_tracks functions in GStreamer before 1.10.3 allow remote attackers to cause a denial of service (crash) via vectors involving stream tags.
- CVE-2017-5840High
The qtdemux_parse_samples function in gst/isomp4/qtdemux.c in GStreamer before version 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving the current stts index.
- CVE-2017-5838High
The gst_date_time_new_from_iso8601_string function in GStreamer before version 1.10.3 allows remote attackers to cause a denial of service via a malformed datetime string, leading to an out-of-bounds heap read.
- CVE-2016-9447High
The ROM mappings in the NSF decoder in gstreamer 0.10.x allow remote attackers to cause a denial of service (out-of-bounds read or write) and possibly execute arbitrary code via a crafted NSF music file.
- CVE-2016-9446High
The vmnc decoder in gstreamer does not initialize the render canvas, allowing remote attackers to obtain sensitive information. This is demonstrated by thumbnailing a simple 1 frame vmnc movie that does not draw to the allocated render canvas.
- CVE-2016-9445High
Integer overflow in the vmnc decoder in gstreamer allows remote attackers to cause a denial of service (crash) via large width and height values, which triggers a buffer overflow.
- CVE-2016-9809High
Off-by-one error in the gst_h264_parse_set_caps function in GStreamer before version 1.10.2 allows remote attackers to have unspecified impact via a crafted file, leading to an out-of-bounds read.
- CVE-2016-9808High
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via a crafted series of skip and count pairs.
- CVE-2026-18299High
Use-After-Free vulnerability in GStreamer rtpsbcdepay allows remote code execution. Lack of validating object existence before operations leads to use-after-free. An attacker can leverage this to execute code in the context of the current process.
Original NVD description (English source)
GStreamer H.266 Codec Parser Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of APS units. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28911.