GStreamer RealMedia Demuxer out-of-bounds

Summaryinfo

A vulnerability was found in GStreamer. It has been classified as problematic. Affected by this issue is some unknown functionality of the component RealMedia Demuxer. Performing a manipulation results in out-of-bounds. This vulnerability is cataloged as CVE-2026-53703. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in GStreamer (unknown version). It has been classified as critical. This affects an unknown code block of the component RealMedia Demuxer. The manipulation with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability was found in the GStreamer RealMedia demuxer (gst-plugins-ugly). When processing a RealMedia (.rm) file, the demuxer parses MDPR (media properties) chunks to configure audio streams. For audio stream header versions 4 and 5, the parser reads fields such as codec type, packet size, sample rate, channel count, and extra codec data length from fixed offsets within the chunk without first checking that the chunk contains enough data. If a malicious file provides an MDPR chunk that is too small to contain a complete audio stream header, the parser reads beyond the end of the buffer. This can cause the application to crash. In some cases, bytes read past the buffer boundary may be incorporated into stream metadata, which could result in limited information disclosure.

The advisory is shared at access.redhat.com. This vulnerability is uniquely identified as CVE-2026-53703 since 06/10/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 321134 (Linux Distros Unpatched Vulnerability : CVE-2026-53703), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (321134) and CERT Bund (WID-SEC-2026-1919). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Open Source GStreamer

Productinfo

Type

• Multimedia Processing Software

Name

• GStreamer

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion