CVE-2026-86476

A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-checked during deserialization, and the video frame mapping code does not verify that the declared plane geometry fits within the buffer before allowing consumers to read or write video data. A local attacker who controls the sending side of a GStreamer inter-process IPC pipeline can deliver a crafted buffer carrying fabricated strides, causing the receiving process to read or write beyond heap boundaries. Successful exploitation can cause a denial of service or potentially allow code execution within the affected process.

Red Hat is evaluating product impact for gst-plugins-base (libgstvideo) across supported streams. Upstream has confirmed the issue is valid and expects a fix in GStreamer 1.28.8 (target approximately October 2026). Coordinated public disclosure date is pending confirmation from upstream. The practical cross-process attack path requires GStreamer 1.24 or later with the unixfd plugin (unixfdsink/unixfdsrc), which serializes GstVideoMeta over Unix domain sockets. Upstream states the unixfd plugin is not used by software packaged in Red Hat Enterprise Linux or major Linux distributions, and the affected elements are not engaged automatically, limiting real-world exposure. Earlier GStreamer versions lack the unixfd IPC path but may still be affected by the underlying libgstvideo validation gap for in-process use. Red Hat Enterprise Linux builds ship with standard compiler hardening (PIE, Full RELRO, stack protector, _FORTIFY_SOURCE), and ASLR is enabled by default. These controls increase the difficulty of reliable code execution beyond denial of service but do not prevent the heap out-of-bounds access itself. On platforms where GStreamer runs inside a sandbox (for example Flatpak without shared IPC namespace), cross-process unixfd communication may be restricted, reducing exposure to the untrusted-sender scenario.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If inter-process video sharing via unixfd is not required, build or deploy GStreamer without the unixfd plugin (for example meson option -Dgst-plugins-bad:unixfd=disabled, or omit libgstunixfd.so from the GStreamer plugin directory). Upstream confirms this is the only practical mitigation for the cross-process attack path and notes the unixfd plugin is not currently used by Red Hat-packaged or major distribution software. Operational policy to avoid connecting receiver pipelines to Unix socket endpoints controlled by untrusted local processes provides equivalent protection without rebuilding. This does not address the underlying validation gap in libgstvideo when attacker-controlled GstVideoMeta is supplied in-process.