GStreamer Bugs Allow RCE Via Crafted Media Files

Two new HIGH-severity CVEs landed in GStreamer overnight — both triggered by processing attacker-controlled media files, one with a realistic path to arbitrary code execution.

CVE-2026-19387 (CVSS 7.6) is in the adpcmdec element of gst-plugins-bad. The IMA/DVI ADPCM decoder uses a per-block sample count to size its output buffer for multi-channel streams but does not validate that count before writing decoded samples. A crafted WAV file can push the write past the end of the allocation. Red Hat’s advisory lists the worst-case outcome as arbitrary code execution; the more common result is a crash.

CVE-2026-19389 (CVSS 7.1) sits in gst-plugins-ugly’s ASF demuxer — the code path for .asf, .wmv, and .wma files. Multiple integer overflow and underflow conditions let attacker-supplied length values in the file header bypass bounds checks and cause out-of-bounds heap reads. Depending on what occupies adjacent memory, that lands somewhere between crash, denial of service, and information disclosure.

Neither CVE has appeared on the CISA KEV catalog as of this writing, and there is no reported public exploitation.

What’s in scope

GStreamer is the media pipeline framework underlying most Linux desktop stacks — GNOME, KDE, and anything that builds on GLib. gst-plugins-bad and gst-plugins-ugly ship as standard packages in Fedora, RHEL, Ubuntu, Debian, and derivatives. Anything that passes untrusted media through a GStreamer pipeline is in scope: desktop media players, web browser media stacks, video conferencing clients, embedded streaming devices.

The attack surface here is “open a file” or “play a stream.” That is a wide net.

What to do

Update gst-plugins-bad and gst-plugins-ugly via your distribution’s package manager. Red Hat has issued advisories for both CVEs; distribution-specific package updates will follow the standard errata process. If updated packages are not yet available from your distro, limit GStreamer’s exposure to untrusted input where possible — most media player applications have options to disable network stream handling or restrict accepted formats.

The consistent part

A C-based media parsing library with dozens of format-specific code paths, each one independently responsible for validating attacker-controlled length fields, accumulates exactly these bugs over time. The class — trust a size value, allocate a buffer, skip the range check — appears in GStreamer today the same way it appeared in libpng in 2011, in FFmpeg in 2016, in libvpx in 2023. The library gets a CVE, the distros ship a patch, the embedded builds stay unpatched for years.

That last part is the actual exposure window. The desktop update is usually fast; the consumer NAS, the IP camera, the conference-room display — those ship gst-plugins-bad and rarely see another update after the box leaves the factory.