CVE-2026-59692
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
A stack buffer overflow vulnerability exists in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is copied into a fixed-size 2048-byte stack buffer without bounds checking. A remote unauthenticated attacker can send a certificate with an oversized Subject DN, causing a stack buffer overflow and process crash.
Risk Assessment
An attacker can remotely crash the GStreamer process, leading to denial of service (DoS). The vulnerability can be exploited without authentication, increasing the risk for systems using DTLS.
Recommendation
Update GStreamer immediately to a version containing the fix for this vulnerability. If an update is not possible, restrict access to services using DTLS to trusted networks only.
Other vulnerabilities in GStreamer
See all- CVE-2026-17072Low
In GStreamer's gst-plugins-good, a heap-based out-of-bounds read of 4 bytes occurs when parsing FLAC audio stream headers embedded in Matroska or WebM container files. A boundary check does not account for the full size of the copied data, allowing a small read past the end of the allocated buffer. An attacker can exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it.
- CVE-2017-5843High
Multiple use-after-free vulnerabilities in the gst_mini_object_unref, gst_tag_list_unref, and gst_mxf_demux_update_essence_tracks functions in GStreamer before 1.10.3 allow remote attackers to cause a denial of service (crash) via vectors involving stream tags.
- CVE-2017-5840High
The qtdemux_parse_samples function in gst/isomp4/qtdemux.c in GStreamer before version 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving the current stts index.
- CVE-2017-5838High
The gst_date_time_new_from_iso8601_string function in GStreamer before version 1.10.3 allows remote attackers to cause a denial of service via a malformed datetime string, leading to an out-of-bounds heap read.
- CVE-2016-9447High
The ROM mappings in the NSF decoder in gstreamer 0.10.x allow remote attackers to cause a denial of service (out-of-bounds read or write) and possibly execute arbitrary code via a crafted NSF music file.
- CVE-2016-9446High
The vmnc decoder in gstreamer does not initialize the render canvas, allowing remote attackers to obtain sensitive information. This is demonstrated by thumbnailing a simple 1 frame vmnc movie that does not draw to the allocated render canvas.
- CVE-2016-9445High
Integer overflow in the vmnc decoder in gstreamer allows remote attackers to cause a denial of service (crash) via large width and height values, which triggers a buffer overflow.
- CVE-2016-9809High
Off-by-one error in the gst_h264_parse_set_caps function in GStreamer before version 1.10.2 allows remote attackers to have unspecified impact via a crafted file, leading to an out-of-bounds read.
- CVE-2016-9808High
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via a crafted series of skip and count pairs.
- CVE-2026-18299High
Use-After-Free vulnerability in GStreamer rtpsbcdepay allows remote code execution. Lack of validating object existence before operations leads to use-after-free. An attacker can leverage this to execute code in the context of the current process.
Original NVD description (English source)
A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed into a fixed-size 2048-byte stack buffer without bounds checking. A remote unauthenticated attacker can send a certificate with an oversized Subject DN that exceeds the buffer, causing a stack buffer overflow and process crash, resulting in denial of service.