CVE-2026-2923

A flaw was found in GStreamer. This out-of-bounds write vulnerability in the DVB (Digital Video Broadcasting) Subtitles handling allows remote attackers to execute arbitrary code. The issue stems from improper validation of user-supplied coordinate data, which can lead to writing beyond the boundaries of an allocated memory buffer. Successful exploitation can result in arbitrary code execution within the context of the current process.

IMPORTANT: A vulnerability in GStreamer's DVB subtitles component allows remote code execution due to an out-of-bounds write caused by improper validation of user-supplied data. This affects Red Hat Enterprise Linux versions that include GStreamer. Exploitation requires interaction with the GStreamer library, typically through processing malicious DVB subtitle streams.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid processing untrusted DVB subtitle streams with GStreamer. Limiting exposure to untrusted content can reduce the risk of exploitation.