CVE-2026-18297

EUVD-2026-63446
GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of OGG files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29584.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
NONE
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 13.54%
Affected Products (NVD)
VendorProductVersion
gstreamergstreamer
𝑥
< 1.28.5
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
gst-plugins-base1.0
bookworm
vulnerable
bookworm (security)
vulnerable
forky
1.28.7-1
fixed
sid
1.28.7-1
fixed
trixie
vulnerable
trixie (security)
1.26.2-1+deb13u2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
gstreamer1.0
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
not-affected
resolute
not-affected
xenial
not-affected
gst-plugins-base1.0
bionic
Fixed 1.14.5-0ubuntu1~18.04.3+esm4
released
focal
Fixed 1.16.3-0ubuntu1.4+esm3
released
jammy
Fixed 1.20.1-1ubuntu0.7
released
noble
Fixed 1.24.2-1ubuntu0.5
released
resolute
Fixed 1.28.2-1ubuntu0.1
released
xenial
Fixed 1.8.3-1ubuntu0.3+esm5
released
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
gstreamer1-plugins-base
RHEL 8
0:1.16.1-6.el8_10.1
fixed
RHEL 8.4 AUS
0:1.16.1-4.el8_4.1
fixed
RHEL 8.6 AUS
0:1.16.1-4.el8_6.1
fixed
RHEL 8.8 E4S
0:1.16.1-4.el8_8.1
fixed
RHEL 8.8 TUS
0:1.16.1-4.el8_8.1
fixed
RHEL 9
0:1.22.12-8.el9_8.2
fixed
gstreamer1-plugins-base-devel
RHEL 8
0:1.16.1-6.el8_10.1
fixed
RHEL 8.4 AUS
0:1.16.1-4.el8_4.1
fixed
RHEL 8.6 AUS
0:1.16.1-4.el8_6.1
fixed
RHEL 8.8 E4S
0:1.16.1-4.el8_8.1
fixed
RHEL 8.8 TUS
0:1.16.1-4.el8_8.1
fixed
RHEL 9
0:1.22.12-8.el9_8.2
fixed
gstreamer1-plugins-base-tools
RHEL 9
0:1.22.12-8.el9_8.2
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
gstreamer1-plugins-base
Amazon Linux 2
0:1.18.4-5.amzn2.0.11
fixed
Amazon Linux 2023
0:1.24.10-1.amzn2023.0.4
fixed
gstreamer1-plugins-base-debuginfo
Amazon Linux 2
0:1.18.4-5.amzn2.0.11
fixed
Amazon Linux 2023
0:1.24.10-1.amzn2023.0.4
fixed
gstreamer1-plugins-base-debugsource
Amazon Linux 2023
0:1.24.10-1.amzn2023.0.4
fixed
gstreamer1-plugins-base-devel
Amazon Linux 2
0:1.18.4-5.amzn2.0.11
fixed
Amazon Linux 2023
0:1.24.10-1.amzn2023.0.4
fixed
gstreamer1-plugins-base-tools
Amazon Linux 2
0:1.18.4-5.amzn2.0.11
fixed
Amazon Linux 2023
0:1.24.10-1.amzn2023.0.4
fixed
gstreamer1-plugins-base-tools-debuginfo
Amazon Linux 2023
0:1.24.10-1.amzn2023.0.4
fixed
Common Weakness Enumeration
References
https://gstreamer.freedesktop.org/security/sa-2026-0053.html
https://www.zerodayinitiative.com/advisories/ZDI-26-465/