CVE-2026-3085

A flaw was found in GStreamer. This heap-based buffer overflow vulnerability in the rtpqdm2depay component allows a remote attacker to execute arbitrary code. The flaw occurs due to insufficient validation of user-supplied data length during the processing of X-QDM Real-time Transport Protocol (RTP) payloads. Successful exploitation can lead to remote code execution within the context of the current process.

This is an IMPORTANT vulnerability in the GStreamer rtpqdm2depay plugin. The flaw enables remote code execution through a heap-based buffer overflow when processing specially crafted X-QDM RTP payloads. Exploitation requires an application to interact with the vulnerable GStreamer library to process such untrusted media streams.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid processing X-QDM RTP payloads from untrusted sources. Restricting network access to applications that utilize GStreamer for RTP stream processing can limit exposure.