CVE-2026-86476
Description
A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-checked during deserialization, and the video frame mapping code does not verify that the declared plane geometry fits within the buffer before allowing consumers to read or write video data. A local attacker who controls the sending side of a GStreamer inter-process IPC pipeline can deliver a crafted buffer carrying fabricated strides, causing the receiving process to read or write beyond heap boundaries. Successful exploitation can cause a denial of service or potentially allow code execution within the affected process.
Statement
Red Hat is evaluating product impact for gst-plugins-base (libgstvideo) across supported streams. Upstream has confirmed the issue is valid and expects a fix in GStreamer 1.28.8 (target approximately October 2026). Coordinated public disclosure date is pending confirmation from upstream. The practical cross-process attack path requires GStreamer 1.24 or later with the unixfd plugin (unixfdsink/unixfdsrc), which serializes GstVideoMeta over Unix domain sockets. Upstream states the unixfd plugin is not used by software packaged in Red Hat Enterprise Linux or major Linux distributions, and the affected elements are not engaged automatically, limiting real-world exposure. Earlier GStreamer versions lack the unixfd IPC path but may still be affected by the underlying libgstvideo validation gap for in-process use. Red Hat Enterprise Linux builds ship with standard compiler hardening (PIE, Full RELRO, stack protector, _FORTIFY_SOURCE), and ASLR is enabled by default. These controls increase the difficulty of reliable code execution beyond denial of service but do not prevent the heap out-of-bounds access itself. On platforms where GStreamer runs inside a sandbox (for example Flatpak without shared IPC namespace), cross-process unixfd communication may be restricted, reducing exposure to the untrusted-sender scenario.
Mitigation
If inter-process video sharing via unixfd is not required, build or deploy GStreamer without the unixfd plugin (for example meson option -Dgst-plugins-bad:unixfd=disabled, or omit libgstunixfd.so from the GStreamer plugin directory). Upstream confirms this is the only practical mitigation for the cross-process attack path and notes the unixfd plugin is not currently used by Red Hat-packaged or major distribution software. Operational policy to avoid connecting receiver pipelines to Unix socket endpoints controlled by untrusted local processes provides equivalent protection without rebuilding. This does not address the underlying validation gap in libgstvideo when attacker-controlled GstVideoMeta is supplied in-process.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.4 | N/A | 8.4 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
Local attacker on same host can control unixfd sender to deliver fabricated GstVideoMeta strides; receiver process crashes (A:H) and heap OOB read/write enable info leak (C:H) and potential RCE (I:H) within the process. No special privileges or user interaction needed once pipelines are running.
Acknowledgements
Red Hat would like to thank Yehia Ezzat (Independent researcher) for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
