Security Advisory 2026-0005 (CVE-2026-2922, ZDI-CAN-28845)
|
|
| Summary |
Out-of-bounds write in RealMedia Demuxer |
| Date |
2026-02-25 |
| Affected Versions |
GStreamer gst-plugins-ugly < 1.28.1 |
| IDs |
GStreamer-SA-2026-0005
CVE-2026-2922
ZDI-CAN-28845 |
Details
An out-of-bounds write in the RealMedia demuxer that can cause crashes for
certain input files.
Impact
It is possible for a malicious third party to trigger out-of-bounds writes to
heap memory, which can result in a crash of the application.
Solution
The gst-plugins-ugly 1.28.1 release addresses the issue. People using older
versions of GStreamer should apply the patch and recompile.
References
The GStreamer project
CVE Database Entries
GStreamer releases
1.28 (current stable)
Patches
