VulnSocial

CVE-2026-2920Disclosure(gstreamer / gstreamer)

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch gstreamer gstreamer systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of stream headers within ASF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28843.

gstreamer CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-122CWE-120

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • gstreamer

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-03-13); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
gstreamer
Products
gstreamer

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-03-13: 1Mentions · 2026-04-05: 1Patch / Workaround · 2026-04-05: 1Technical Details · 2026-04-05: 103-1304-05
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-03-131
Disclosure1
2026-04-051
Patch1
Full discourse2 posts
  • ThreatCluster@threatcluster
    Patch

    BREAKING: Critical RCE flaws CVE-2026-3084 and CVE-2026-2920 in GStreamer allow code execution via crafted ASF files, impacting Debian 12 and Fedora 42 users until updated to 1.26.11. https://threatcluster.io/cluster/critical-rce-vulnerabilities-in-gstreamer-affect-debian-and--4a961f45

    Post summary

    The alert discloses critical RCE flaws in GStreamer affecting Debian 12 and Fedora 42, with a recommended patch update to version 1.26.11.

    0000057
    124 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-2920 GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected i… https://www.cve.org/CVERecord?id=CVE-2026-2920

    Post summary

    The text announces the CVE‑2026‑2920 vulnerability in GStreamer ASF demuxer, stating that remote attackers can achieve arbitrary code execution, but provides no further technical or mitigation details.

    00000144
    56.7K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appgstreamergstreamer---

Explore more

Back to dashboardgstreamer CVEsgstreamer vulnerabilities