CVE-2026-3084

A flaw was found in GStreamer. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. The issue stems from an integer underflow during the parsing of H.266 video codec picture partitions, caused by insufficient validation of user-supplied data. Successful exploitation can lead to remote code execution in the context of the current process.

IMPORTANT: This vulnerability in GStreamer's H.266 codec parser could lead to remote code execution due to an integer underflow when processing specially crafted H.266 media files. Red Hat Enterprise Linux systems are affected if they process untrusted H.266 content, as exploitation requires user interaction with such a file.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.