CVE-2026-86476 in Red Hat
Summary
by MITRE • 10/14/2026
A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-checked during deserialization, and the video frame mapping code does not verify that the declared plane geometry fits within the buffer before allowing consumers to read or write video data. A local attacker who controls the sending side of a GStreamer inter-process IPC pipeline can deliver a crafted buffer carrying fabricated strides, causing the receiving process to read or write beyond heap boundaries. Successful exploitation can cause a denial of service or potentially allow code execution within the affected process.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in gst-plugins-base represents a critical memory safety issue rooted in insufficient input validation during the processing of video buffers. Specifically, this flaw involves a heap buffer overflow that occurs when the GstVideoMeta metadata attached to a video buffer declares plane strides and offsets that exceed the actual backing memory allocation size. In normal operation, GStreamer relies on these metadata structures to define how video data is laid out in memory, including dimensions such as width, height, and stride for each color plane. When an application or pipeline component deserializes this metadata from a received buffer, it assumes the declared geometry accurately reflects the underlying memory layout without performing rigorous range checks against the actual allocated heap space. This lack of verification creates a dangerous discrepancy between what the software believes is available and what is actually present in memory.
The technical mechanism of exploitation hinges on the failure to validate plane geometry before allowing consumers to access video data. During deserialization, the system accepts fabricated strides and offsets provided by the sender side of an inter-process IPC pipeline without cross-referencing them against the buffer's actual capacity. Consequently, when a consumer process attempts to map or read from this buffer based on the maliciously crafted metadata, it is directed to memory addresses outside the bounds of the allocated heap region. This results in out-of-bounds reads and writes, which are classic indicators of CWE-120 Buffer Copy without Checking Size of Input and CWE-787 Out-of-bounds Write. The absence of boundary checks allows an attacker to corrupt adjacent heap metadata or overwrite critical data structures located immediately after the video buffer allocation.
From a threat actor perspective, this vulnerability requires local access with control over the sending side of a GStreamer inter-process communication pipeline. This constraint limits the attack surface primarily to scenarios where multiple processes interact via shared memory or IPC mechanisms managed by GStreamer, such as in complex multimedia pipelines involving separate encoder and decoder components running in different contexts. A local attacker who can inject crafted buffers into this pipeline can trigger the overflow condition remotely within the context of the receiving process. The operational impact is severe, ranging from a denial of service to potential arbitrary code execution. If the heap corruption affects control flow data such as function pointers or return addresses on the stack, an attacker may achieve remote code execution with the privileges of the affected application. This aligns with ATT&CK technique T1059 Command and Scripting Interpreter if used for initial access via a crafted file, though in this IPC context it is more akin to direct exploitation of memory corruption primitives leading to privilege escalation or service disruption within the host environment.
Mitigation strategies must focus on enforcing strict validation at the point of metadata deserialization and buffer mapping. Developers should implement comprehensive range checks that verify declared strides, offsets, and dimensions against the actual allocated size of the backing memory before any read or write operations are permitted. This includes validating that calculated end addresses do not exceed the upper bound of the heap allocation. Additionally, employing static analysis tools configured to detect out-of-bounds access patterns during development can help identify similar flaws in related components. For system administrators and users, updating gst-plugins-base to a patched version that incorporates these validation checks is essential to close this security gap. Until patches are applied, isolating untrusted media processing pipelines from sensitive processes or restricting IPC permissions can reduce the risk of exploitation by limiting the ability of malicious actors to inject crafted buffers into critical video processing workflows.