GStreamer gst-plugins-good gdkgpixbufdec Heap Buffer Overflow Vulnerability (CVE-2026-18298) Security Advisory

Vulnerability Overview Vulnerability Name: Security Advisory 2026-0052 (CVE-2026-18298) Release Date: 2026-07-08 Vulnerability Type: Heap buffer overflow Affected Component: GStreamer gst-plugins-good < 1.28.5 Vulnerability Description: A heap buffer overflow vulnerability exists in the element of gst-plugins-good (an image decoder based on GdkPixbuf). When initializing the output buffer pool, this element only allocates buffers based on the dimensions of the first decoded frame and does not re-evaluate or reconfigure to handle different dimensions or pixel formats in subsequent frames. When processing an image sequence, if a subsequent frame is larger than the first frame, the element retrieves uninitialized output buffers from the state pool and writes decoded pixel data beyond the buffer boundaries, resulting in a heap buffer overflow. The overflow magnitude is proportional to the size difference. Impact Scope Affected Versions: GStreamer gst-plugins-good < 1.28.5 Potential Risks: Malicious third parties can trigger the heap buffer overflow by providing a specially crafted image sequence (with increasing frame sizes), which may cause application crashes, denial of service, data corruption, or arbitrary code execution. Remediation Fixed Version: GStreamer gst-plugins-good 1.28.5 Remediation Measures: - Ensure the output buffer pool is re-evaluated when frame dimensions or pixel formats change. - Lower the priority of the element from SECONDARY to NONE, as the underlying library is not designed to handle additional input and should not be automatically selected for decoding images from untrusted sources. - It is recommended to use higher-level dedicated decoders as alternatives. Refer to issue #764 for more appropriate replacement options. Temporary Mitigation: Users of older GStreamer versions should apply the patch and recompile, or disable the plugin to mitigate the vulnerability. References GStreamer Project CVE Database Entries GStreamer 1.28.5 release - Release Notes - GStreamer Plugins Good 1.28.5 Patches POC Code No POC code or exploit code is provided on the page.

Goal Reached Thanks to every supporter — we hit 100%!

GStreamer gst-plugins-good gdkgpixbufdec Heap Buffer Overflow Vulnerability (CVE-2026-18298) Security Advisory