CVE-2026-3085

EUVD-2026-12129

16.03.2026, 14:19

GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the processing of X-QDM RTP payloads. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28851.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8.8 HIGH	NETWORK	LOW	NONE	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 49%

Affected Products (NVD)

Vendor	Product	Version
gstreamer	gstreamer	𝑥 < 1.28.1

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

gst-plugins-good1.0

bookworm	no-dsa
bookworm (security)	vulnerable
bullseye	postponed
bullseye (security)	vulnerable
forky	1.28.3-1 fixed
sid	1.28.3-1 fixed
trixie	no-dsa
trixie (security)	vulnerable

Ubuntu Releases

Ubuntu Product

Codename

gst-plugins-good1.0

bionic	needs-triage
focal	needs-triage
jammy	Fixed 1.20.3-0ubuntu1.5 released
noble	Fixed 1.24.2-1ubuntu1.3 released
questing	Fixed 1.26.5-1ubuntu2.1 released
resolute	not-affected
xenial	needs-triage

Red Hat Enterprise Linux Releases

Red Hat Product

Release

gstreamer1-plugins-bad-free

RHEL 8	0:1.16.1-6.el8_10 fixed
RHEL 8.2 AUS	0:1.16.1-4.el8_2 fixed
RHEL 8.4 AUS	0:1.16.1-4.el8_4 fixed
RHEL 8.6 AUS	0:1.16.1-4.el8_6 fixed
RHEL 8.6 E4S	0:1.16.1-4.el8_6 fixed
RHEL 8.6 TUS	0:1.16.1-4.el8_6 fixed
RHEL 8.8 E4S	0:1.16.1-4.el8_8 fixed
RHEL 8.8 TUS	0:1.16.1-4.el8_8 fixed
RHEL 9	0:1.22.12-5.el9_7 fixed

gstreamer1-plugins-bad-free-devel

RHEL 8	0:1.16.1-6.el8_10 fixed
RHEL 9	0:1.22.12-5.el9_7 fixed

gstreamer1-plugins-bad-free-libs

RHEL 9

0:1.22.12-5.el9_7

fixed

gstreamer1-plugins-base

RHEL 8	0:1.16.1-6.el8_10 fixed
RHEL 8.2 AUS	0:1.16.1-3.el8_2 fixed
RHEL 8.4 AUS	0:1.16.1-4.el8_4 fixed
RHEL 8.6 AUS	0:1.16.1-4.el8_6 fixed
RHEL 8.6 E4S	0:1.16.1-4.el8_6 fixed
RHEL 8.6 TUS	0:1.16.1-4.el8_6 fixed
RHEL 8.8 E4S	0:1.16.1-4.el8_8 fixed
RHEL 8.8 TUS	0:1.16.1-4.el8_8 fixed
RHEL 9	0:1.22.12-5.el9_7 fixed

gstreamer1-plugins-base-devel

RHEL 8	0:1.16.1-6.el8_10 fixed
RHEL 8.2 AUS	0:1.16.1-3.el8_2 fixed
RHEL 8.4 AUS	0:1.16.1-4.el8_4 fixed
RHEL 8.6 AUS	0:1.16.1-4.el8_6 fixed
RHEL 8.6 E4S	0:1.16.1-4.el8_6 fixed
RHEL 8.6 TUS	0:1.16.1-4.el8_6 fixed
RHEL 8.8 E4S	0:1.16.1-4.el8_8 fixed
RHEL 8.8 TUS	0:1.16.1-4.el8_8 fixed
RHEL 9	0:1.22.12-5.el9_7 fixed

gstreamer1-plugins-base-tools

RHEL 9

0:1.22.12-5.el9_7

fixed

gstreamer1-plugins-good

RHEL 8	0:1.16.1-6.el8_10 fixed
RHEL 8.2 AUS	0:1.16.1-3.el8_2 fixed
RHEL 8.4 AUS	0:1.16.1-4.el8_4 fixed
RHEL 8.6 AUS	0:1.16.1-4.el8_6 fixed
RHEL 8.6 E4S	0:1.16.1-4.el8_6 fixed
RHEL 8.6 TUS	0:1.16.1-4.el8_6 fixed
RHEL 8.8 E4S	0:1.16.1-5.el8_8 fixed
RHEL 8.8 TUS	0:1.16.1-5.el8_8 fixed
RHEL 9	0:1.22.12-5.el9_7 fixed

gstreamer1-plugins-good-gtk

RHEL 8	0:1.16.1-6.el8_10 fixed
RHEL 8.2 AUS	0:1.16.1-3.el8_2 fixed
RHEL 8.4 AUS	0:1.16.1-4.el8_4 fixed
RHEL 8.6 AUS	0:1.16.1-4.el8_6 fixed
RHEL 8.6 E4S	0:1.16.1-4.el8_6 fixed
RHEL 8.6 TUS	0:1.16.1-4.el8_6 fixed
RHEL 8.8 E4S	0:1.16.1-5.el8_8 fixed
RHEL 8.8 TUS	0:1.16.1-5.el8_8 fixed
RHEL 9	0:1.22.12-5.el9_7 fixed

gstreamer1-plugins-ugly-free

RHEL 9

0:1.22.12-4.el9_7

fixed

Amazon Linux Releases

Amazon Package

Release

gstreamer1-plugins-good

Amazon Linux 2	0:1.18.4-6.amzn2.0.9 fixed
Amazon Linux 2023	0:1.24.10-1.amzn2023.0.4 fixed

gstreamer1-plugins-good-debuginfo

Amazon Linux 2	0:1.18.4-6.amzn2.0.9 fixed
Amazon Linux 2023	0:1.24.10-1.amzn2023.0.4 fixed

gstreamer1-plugins-good-debugsource

Amazon Linux 2023

0:1.24.10-1.amzn2023.0.4

fixed

gstreamer1-plugins-good-gtk

Amazon Linux 2	0:1.18.4-6.amzn2.0.9 fixed
Amazon Linux 2023	0:1.24.10-1.amzn2023.0.4 fixed

gstreamer1-plugins-good-gtk-debuginfo

Amazon Linux 2023

0:1.24.10-1.amzn2023.0.4

fixed

Common Weakness Enumeration

CWE-122 - Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

References

https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/d60a94dee3c0a0942c9981491bf83e0de1900fbf

https://www.zerodayinitiative.com/advisories/ZDI-26-167/