CVE-2026-86476
8.4HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-787
Impact
A local attacker can crash the receiving service or potentially execute arbitrary code in its context. They need local access and control over the sending side of a GStreamer IPC pipeline.
Root cause
Deserialization and frame mapping fail to validate that plane strides and offsets in GstVideoMeta fit within the backing video buffer, causing an out-of-bounds heap read or write.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade gst-plugins-base once your distribution publishes patched packages. If patching must wait, restrict IPC access to GStreamer pipelines or disable untrusted inter-process pipeline endpoints.
$ sudo dnf upgrade -y gst-plugins-base || sudo apt-get update && sudo apt-get install --only-upgrade -y gstreamer1.0-plugins-baseAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-checked during deserialization, and the video frame mapping code does not verify that the declared plane geometry fits within the buffer before allowing consumers to read or write video data. A local attacker who controls the sending side of a GStreamer inter-process IPC pipeline can deliver a crafted buffer carrying fabricated strides, causing the receiving process to read or write beyond heap boundaries. Successful exploitation can cause a denial of service or potentially allow code execution within the affected process.