GStreamer: Eight CVEs Disclosed Across WavPack, RealMedia, VNC, and AV1 Parsers
GStreamer disclosed eight vulnerabilities on June 15, 2026 — including a CVSS 8.8 heap overflow in the RFB/VNC client and an integer overflow in the WavPack decoder — affecting plugins across the multimedia framework.
Key findings
- Eight GStreamer CVEs disclosed on June 15, 2026, across gst-plugins-good, -bad, and -ugly
- CVE-2026-52720 (CVSS 8.8) is a heap overflow in the RFB/VNC client library
- CVE-2026-53705 (CVSS 7.6) is an integer overflow in the WavPack audio decoder
- Two RealMedia demuxer bugs (CVE-2026-53704, CVE-2026-53703) cause out-of-bounds reads
- CVE-2026-52718 (CVSS 6.5) is an AV1 parser DoS from a byte-vs-bit count mismatch
- No coordinated patch release announced as of disclosure date
On June 15, 2026, the GStreamer project disclosed eight distinct vulnerabilities spanning multiple media parsers and decoders. The batch, which includes seven High-severity flaws and two Medium-severity issues, affects components across the gst-plugins-good, gst-plugins-bad, and gst-plugins-ugly plugin sets. Given GStreamer's widespread use in Linux desktops, embedded devices, and media applications, these bugs collectively represent a significant attack surface for attackers seeking remote code execution or denial of service via crafted media files.
Two of the most severe bugs reside in the WavPack audio decoder and the RFB/VNC client library. CVE-2026-53705 (CVSS 7.6) is an integer overflow in gst_wavpack_dec_handle_frame() within gst-plugins-good. The flawed calculation 4 * block_samples * channels can produce a very small heap allocation, which the WavPack library then overflows when writing decoded audio data. CVE-2026-52720 (CVSS 8.8) is a heap buffer overflow in the librfb RFB client. The rectangle bounds check validates total area rather than individual width and height dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the allocated framebuffer. An attacker who tricks a user into connecting to a rogue VNC server could achieve heap corruption and likely code execution.
The RealMedia demuxer in gst-plugins-ugly is hit by two High-severity bugs. CVE-2026-53704 (CVSS 7.1) involves the FILEINFO metadata parser, where re_skip_pascal_string() fails to validate that offsets remain within the mapped buffer, leading to out-of-bounds reads. CVE-2026-53703 (CVSS 7.1) targets the MDPR (media properties) chunk parser for audio streams with header versions 4 and 5; improper validation of fields such as codec type, packet size, and sample rate can also trigger out-of-bounds reads.
Three additional High-severity bugs affect other decoders. CVE-2026-52722 (CVSS 7.1) is a signed integer overflow in the VMnc decoder — large cursor dimensions can bypass a length check and cause out-of-bounds reads. CVE-2026-52719 (CVSS 7.1) is an out-of-bounds read in the VA JPEG decoder within gst-plugins-bad, where the parser reads a segment length from the bitstream without validating it against available data. CVE-2026-52718 (CVSS 6.5, Medium) is a denial-of-service bug in the AV1 codec parser: gst_av1_parser_parse_tile_list_obu() passes a byte count to a bit-reader API that expects a bit count, causing parser desynchronization and crashes.
Finally, CVE-2026-52721 (CVSS 5.3, Medium) covers multiple out-of-bounds read issues in the pcapparse element. Malformed PCAP records can trigger reads beyond buffer boundaries during IPv4/TCP header parsing. The element is primarily used in debugging pipelines, which limits real-world exposure, but a local attacker could still exploit it by tricking a user into processing a crafted PCAP file.
As of the disclosure date, GStreamer maintainers have not yet released a coordinated patch advisory for all eight CVEs. Users and distributors should monitor the GStreamer security page for updated packages. In the interim, the safest mitigation is to avoid opening untrusted media files — particularly WavPack, RealMedia, VMnc, AV1, and JPEG streams — in any application that relies on the affected GStreamer plugins.
This batch underscores the challenge of securing a multimedia framework that must parse dozens of legacy and modern container formats. The concentration of memory-safety bugs in parsers and decoders — integer overflows, heap overflows, and out-of-bounds reads — is a recurring pattern in GStreamer's disclosure history. Users of Linux distributions, embedded systems, and media software that bundles GStreamer should prioritize updates once patches land in their respective package repositories.