{"id":163928,"date":"2026-03-11T17:11:54","date_gmt":"2026-03-11T15:11:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/10-uyazvimostej-v-gstreamer-privodyashhih-k-udalyonnomu-vypolneniyu-koda"},"modified":"2026-03-11T17:11:54","modified_gmt":"2026-03-11T15:11:54","slug":"10-uyazvimostej-v-gstreamer-privodyashhih-k-udalyonnomu-vypolneniyu-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/10-uyazvimostej-v-gstreamer-privodyashhih-k-udalyonnomu-vypolneniyu-koda","title":{"rendered":"10 vulnerabilities in GStreamer leading to remote code execution","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The multimedia framework GStreamer used in GNOME has identified 10 vulnerabilities, all of which are marked as allowing remote code execution when processing malformed multimedia data in AVI, RTP, H.266, JPEG, ASF, and RealMedia formats, as well as DVB-SUB subtitles. Two issues have a severity rating of 8.8 out of 10, while the others have a rating of 7.8. Eight vulnerabilities lead to buffer overflows, and two to integer overflows. <\/p>\n
\n
CVE-2026-3085, CVE-2026-3083 \u2014 buffer overflow in the rtp plugin, caused by inadequate checks on size and data when processing X-QDM RTP fields.\n
CVE-2026-2923 \u2014 buffer overflow when processing incorrect coordinates in DVB-SUB subtitles.\n
CVE-2026-3081 \u2014 buffer overflow due to improper size checks of structures when parsing the H.266 (VVC, Versatile Video Coding) format.\n
CVE-2026-3082 \u2014 buffer overflow due to lack of proper size checks when parsing Huffman tables in JPEG images.\n
CVE-2026-2920 \u2014 buffer overflow due to lack of proper size checks when parsing multimedia container headers in ASF format.\n
CVE-2026-2922 \u2014 buffer overflow due to improper structure checks when parsing multimedia containers in RealMedia format.\n
CVE-2026-2921 \u2014 integer overflow when parsing RIFF blocks with palettes in AVI files.\n
CVE-2026-3084 \u2014 integer overflow in the implementation of the H.266 codec when parsing sections containing images.\n
CVE-2026-3086 \u2014 buffer overflow in the implementation of the H.266 codec when parsing APS blocks. <\/ul>\n
The GStreamer library is used to parse multimedia files in the Nautilus (GNOME Files), GNOME Videos, and Rhythmbox applications, as well as in the GNOME-developed search engine localsearch (formerly known as tracker-miners). This engine is installed in many distributions as a dependency for the tracker-extract package, which is used in GNOME to automatically parse metadata in new files. Among other things, this service indexes all files in the home directory without any action from the user. Thus, for an attack, it is sufficient to place a specially created multimedia file in the user's directory, and the vulnerability will be exploited during its automatic indexing. <\/p>\n
In most distributions with GNOME, localsearch components (tracker-miners) are enabled by default and loaded as a hard dependency for the Nautilus file manager (GNOME Files). Starting with GNOME 46, the localsearch process is launched using sandbox isolation. To disable metadata extraction, you can delete the rule files from the directory \/usr\/share\/localsearch3\/extract-rules\/ or \/usr\/share\/tracker3-miners\/extract-rules\/. <\/p>\n