CVE-2026-3086

A flaw was found in GStreamer. A remote attacker could exploit this out-of-bounds write vulnerability by providing specially crafted H.266 video data. This issue, specifically within the processing of Adaptation Parameter Set (APS) units, stems from insufficient validation of user-supplied data, leading to a write beyond the allocated buffer. Successful exploitation allows the attacker to execute arbitrary code on the system where GStreamer is running.

This vulnerability is rated as IMPORTANT. It affects the GStreamer H.266 Codec Parser, which is included in Red Hat Enterprise Linux versions 6, 7, 8, 9, and 10. Exploitation requires processing specially crafted H.266 media content, which could lead to remote code execution in the context of the current process.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.