CVE-2026-18298

A flaw was found in GStreamer. This vulnerability, a heap-based buffer overflow during PNG file parsing, allows a remote attacker to execute arbitrary code. Successful exploitation requires user interaction, such as opening a malicious PNG file or visiting a specially crafted web page. The issue arises from inadequate validation of user-supplied data length, which can lead to code execution within the context of the affected process.

This vulnerability is rated as an Important severity for Red Hat Enterprise Linux because arbitrary code execution can occur within the privileges of the active session if a user opens a maliciously crafted PNG image or media stream. Although GStreamer is present on default workstation installs and optional server environments, standard server deployments typically do not process untrusted graphical files unless running dedicated multimedia or rendering services. Furthermore, exploitation requires local user interaction or an application accepting untrusted external media, limiting the risk of spontaneous remote compromise without interaction.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To reduce the risk of exploitation, users should avoid opening or processing untrusted PNG files from unknown or suspicious sources. This operational control is crucial as the vulnerability requires user interaction to trigger the heap-based buffer overflow.