CVE-2026-3083

A flaw was found in GStreamer. This out-of-bounds write vulnerability exists within the rtpqdm2depay element, specifically during the processing of X-QDM Real-time Transport Protocol (RTP) payload elements. A remote attacker can exploit this by providing malformed user-supplied data to the packetid element, leading to a write past the end of an allocated array. Successful exploitation can result in arbitrary code execution in the context of the current process.

This IMPORTANT vulnerability in GStreamer allows remote code execution due to an out-of-bounds write when processing X-QDM RTP payload elements. Red Hat products using GStreamer for RTP stream handling are affected if they process untrusted media streams.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.