8.8

CVE-2026-3085

GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability

GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the processing of X-QDM RTP payloads. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28851.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gstreamer ≫ Gstreamer Version < 1.28.1
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.83% 0.529
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
0b0ca135-0b70-47e7-9f44-1890c2a1c46c 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
zdi-disclosures@trendmicro.com 8.8 2.8 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-122 Heap-based Buffer Overflow

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

CWE-1284 Improper Validation of Specified Quantity in Input

The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/d60a94dee3c0a0942c9981491bf83e0de1900fbf
Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-26-167/
Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:19024
https://access.redhat.com/errata/RHSA-2026:19180
https://access.redhat.com/errata/RHSA-2026:6259
https://access.redhat.com/errata/RHSA-2026:6300
https://access.redhat.com/errata/RHSA-2026:6750
https://access.redhat.com/errata/RHSA-2026:8854
https://access.redhat.com/errata/RHSA-2026:8862
https://access.redhat.com/errata/RHSA-2026:7673
https://access.redhat.com/errata/RHSA-2026:7850
https://access.redhat.com/errata/RHSA-2026:8857
https://access.redhat.com/errata/RHSA-2026:8874
https://access.redhat.com/errata/RHSA-2026:8876
https://access.redhat.com/errata/RHSA-2026:9446
https://access.redhat.com/errata/RHSA-2026:9447
https://access.redhat.com/errata/RHSA-2026:9487
https://access.redhat.com/errata/RHSA-2026:9488
https://access.redhat.com/security/cve/CVE-2026-3085
https://bugzilla.redhat.com/show_bug.cgi?id=2447495
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3085.json