The multimedia framework GStreamer used in GNOME has identified 10 vulnerabilities, all of which are marked as allowing remote code execution when processing malformed multimedia data in AVI, RTP, H.266, JPEG, ASF, and RealMedia formats, as well as DVB-SUB subtitles. Two issues have a severity rating of 8.8 out of 10, while the others have a rating of 7.8. Eight vulnerabilities lead to buffer overflows, and two to integer overflows.
- CVE-2026-3085, CVE-2026-3083 — buffer overflow in the rtp plugin due to lack of proper size and data validation when processing X-QDM RTP fields.
- CVE-2026-2923 — buffer overflow when processing invalid coordinates in DVB-SUB subtitles.
- CVE-2026-3081 — buffer overflow due to improper size validation of structures when parsing H.266 (VVC, Versatile Video Coding) format.
- CVE-2026-3082 — buffer overflow due to lack of proper size checks when parsing Huffman tables in JPEG images.
- CVE-2026-2920 — buffer overflow due to lack of proper size checks when parsing multimedia container headers in ASF format.
- CVE-2026-2922 — buffer overflow due to improper structure checks when parsing multimedia containers in RealMedia format.
- CVE-2026-2921 — integer overflow when parsing RIFF blocks with palette in AVI files.
- CVE-2026-3084 — integer overflow in the implementation of the H.266 codec when parsing sections with images.
- CVE-2026-3086 — buffer overflow in the implementation of the H.266 codec when parsing APS blocks.
The GStreamer library is used to parse multimedia files in the Nautilus (GNOME Files), GNOME Videos, and Rhythmbox applications, as well as in the GNOME-developed search engine localsearch (formerly known as tracker-miners). This engine is installed in many distributions as a dependency for the tracker-extract package, which is used in GNOME to automatically parse metadata in new files. Among other things, this service indexes all files in the home directory without any action from the user. Thus, for an attack, it is sufficient to place a specially created multimedia file in the user's directory, and the vulnerability will be exploited during its automatic indexing.
In most distributions with GNOME, localsearch components (tracker-miners) are enabled by default and loaded as a hard dependency for the Nautilus file manager (GNOME Files). Starting with GNOME 46, the localsearch process is launched using sandbox isolation. To disable metadata extraction, you can delete the rule files from the directory /usr/share/localsearch3/extract-rules/ or /usr/share/tracker3-miners/extract-rules/.
Vulnerabilities have been fixed in the GStreamer 1.28.1 update. The status of vulnerability fixes in distributions can be assessed on these pages (if the page is unavailable, it means the distribution developers have not yet started addressing the issue): Debian, Ubuntu, SUSE, RHEL, Gentoo, Arch, Fedora, FreeBSD.
Source: opennet.ru
