Read the docs
TI-2026-38726 Aliases CVE-2026-53703GHSA-hghw-p2mw-fvch

Gstreamer1-plugins-ugly-free: gstreamer: out-of-bounds read in realmedia demuxer audio stream header parser

Priority LOW 31CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

A vulnerability was found in the GStreamer RealMedia demuxer (gst-plugins-ugly). When processing a RealMedia (.rm) file, the demuxer parses MDPR (media properties) chunks to configure audio streams. For audio stream header versions 4 and 5, the parser reads fields such as codec type, packet size, sample rate, channel count, and extra codec data length from fixed offsets within the chunk without first checking that the chunk contains enough data. If a malicious file provides an MDPR chunk that is too small to contain a complete audio stream header, the parser reads beyond the end of the buffer. This can cause the application to crash. In some cases, bytes read past the buffer boundary may be incorporated into stream metadata, which could result in limited information disclosure.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00245 15th percentileScored 2026-11-07
Fix Fixed Red Hat: 4 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat Enterprise Linux 10—1.26.7-2.el10_2.1Patch availableCNA
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—1.24.11-1.el10_0.2Patch availableCNA
Red HatRed Hat Enterprise Linux 9—1.22.12-6.el9_8.1Patch availableCNA
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—1.22.12-4.el9_6.1Patch availableCNA
Red HatRed Hat Enterprise Linux 7——Not affectedCNA
Red HatRed Hat Enterprise Linux 8——Not affectedCNA
  • Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in 1.26.7-2.el10_2.1 Patch available CNA
  • Red Hat Enterprise Linux 10.0 Extended Update Support VendorRed Hat Affected — Fixed in 1.24.11-1.el10_0.2 Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 1.22.12-6.el9_8.1 Patch available CNA
  • Red Hat Enterprise Linux 9.6 Extended Update Support VendorRed Hat Affected — Fixed in 1.22.12-4.el9_6.1 Patch available CNA
  • Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA

CPE names CNA · 6

CPEVersionsRoleVendor
cpe:/o:redhat:enterprise_linux:10.210.2—Red Hat
cpe:/o:redhat:enterprise_linux_eus:10.010.0—Red Hat
cpe:/a:redhat:enterprise_linux:9::appstream9—Red Hat
cpe:/a:redhat:rhel_eus:9.6::appstream9.6—Red Hat
cpe:/o:redhat:rhel_els:77—Red Hat
cpe:/a:redhat:enterprise_linux:88—Red Hat
  • cpe:/o:redhat:enterprise_linux:10.2 Versions 10.2 — ·Red Hat
  • cpe:/o:redhat:enterprise_linux_eus:10.0 Versions 10.0 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:9::appstream Versions 9 — ·Red Hat
  • cpe:/a:redhat:rhel_eus:9.6::appstream Versions 9.6 — ·Red Hat
  • cpe:/o:redhat:rhel_els:7 Versions 7 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:8 Versions 8 — ·Red Hat

Remediation

Red Hat 4 advisories

  • RHSA-2026:50691 Released 2026-08-05 · Red Hat rating Moderate
    gstreamer1-plugins-ugly-free security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) gstreamer1-plugins-ugly-free-1.22.12-4.el9_6.1
  • RHSA-2026:50688 Released 2026-08-05 · Red Hat rating Moderate
    gstreamer1-plugins-ugly-free security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) gstreamer1-plugins-ugly-free-1.24.11-1.el10_0.2
  • RHSA-2026:36674 Released 2026-07-08 · Red Hat rating Moderate
    gstreamer1-plugins-ugly-free security update
    • Red Hat Enterprise Linux AppStream (v. 9) gstreamer1-plugins-ugly-free-1.22.12-6.el9_8.1
Show 1 more Red Hat advisories
  • RHSA-2026:36673 Released 2026-07-08 · Red Hat rating Moderate
    gstreamer1-plugins-ugly-free security update
    • Red Hat Enterprise Linux AppStream (v. 10) gstreamer1-plugins-ugly-free-1.26.7-2.el10_2.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 4 more products — RHSA-2026:36673

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-38727 Gstreamer1-plugins-ugly-free: gstreamer: out-of-bounds read in realmedia demuxer fileinfo metadata parserPriority LOW 31
    Show all 2 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 4 more products — RHSA-2026:36674

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-38727 Gstreamer1-plugins-ugly-free: gstreamer: out-of-bounds read in realmedia demuxer fileinfo metadata parserPriority LOW 31
    Show all 2 records → Advisory →
Show 2 more groups
  • Advisory ·

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 4 more products — RHSA-2026:50688

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-38727 Gstreamer1-plugins-ugly-free: gstreamer: out-of-bounds read in realmedia demuxer fileinfo metadata parserPriority LOW 31
    Show all 2 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 4 more products — RHSA-2026:50691

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-38727 Gstreamer1-plugins-ugly-free: gstreamer: out-of-bounds read in realmedia demuxer fileinfo metadata parserPriority LOW 31
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:36673
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:36674
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:50688
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:50691
Not affected: 2 products
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53703
  2. 2026-10-03 Alias added: GHSA-hghw-p2mw-fvch

References

Advisory 4

Other 2

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7412 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences