CVE catalog

CVE-2026-86476

Severity: High · CVSS 8.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: Oct 8, 2026, 10:00:00 PM UTC
Updated: Oct 14, 2026, 10:17:56 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.19% · Oct 25, 2026

A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-checked during deserialization, and the video frame mapping code does not verify that the declared plane geometry fits within the buffer before allowing consumers to read or write video data. A local attacker who controls the sending side of a GStreamer inter-process IPC pipeline can deliver a crafted buffer carrying fabricated strides, causing the receiving process to read or write beyond heap boundaries. Successful exploitation can cause a denial of service or potentially allow code execution within the affected process.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	gst-plugins-base1.0	sid	`1.28.8-1`	vulnerable
Debian	gst-plugins-base1.0	forky	`1.28.8-1`	vulnerable
Debian	gst-plugins-base1.0	trixie	`1.26.2-1+deb13u1`	vulnerable
Debian	gst-plugins-base1.0	trixie-security	`1.26.2-1+deb13u2`	vulnerable
Debian	gst-plugins-base1.0	bookworm	`1.22.0-3+deb12u6`	vulnerable
Debian	gst-plugins-base1.0	bookworm-security	`1.22.0-3+deb12u7`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	gst-plugins-base1.0	source	sid	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	gst-plugins-base1.0	source	forky	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	gst-plugins-base1.0	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	gst-plugins-base1.0	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[gir1.2-gst-plugins-base-1.0]Affected
Source package: [gst-plugins-base1.0]
Details (4)
- 1.22.0-3+deb12u6 · amd64 · bookworm
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
- 1.22.0-3+deb12u6 · arm64 · bookworm
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
- 1.22.0-3+deb12u6 · amd64 · bookworm-security
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
- 1.22.0-3+deb12u6 · arm64 · bookworm-security
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
[gstreamer1.0-alsa]Affected
Source package: [gst-plugins-base1.0]
Details (4)
- 1.22.0-3+deb12u6 · amd64 · bookworm
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
- 1.22.0-3+deb12u6 · arm64 · bookworm
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
- 1.22.0-3+deb12u6 · amd64 · bookworm-security
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
- 1.22.0-3+deb12u6 · arm64 · bookworm-security
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
[gstreamer1.0-gl]Affected
Source package: [gst-plugins-base1.0]
Details (4)
- 1.22.0-3+deb12u6 · amd64 · bookworm
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
- 1.22.0-3+deb12u6 · arm64 · bookworm
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
- 1.22.0-3+deb12u6 · amd64 · bookworm-security
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
- 1.22.0-3+deb12u6 · arm64 · bookworm-security
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
[gstreamer1.0-plugins-base]Affected
Source package: [gst-plugins-base1.0]
Details (4)
- 1.22.0-3+deb12u6 · amd64 · bookworm
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
- 1.22.0-3+deb12u6 · arm64 · bookworm
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
- 1.22.0-3+deb12u6 · amd64 · bookworm-security
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
- 1.22.0-3+deb12u6 · arm64 · bookworm-security
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
[gstreamer1.0-plugins-base-apps]Affected
Source package: [gst-plugins-base1.0]
Details (4)
- 1.22.0-3+deb12u6 · amd64 · bookworm
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
- 1.22.0-3+deb12u6 · arm64 · bookworm
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
- 1.22.0-3+deb12u6 · amd64 · bookworm-security
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
- 1.22.0-3+deb12u6 · arm64 · bookworm-security
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
[gstreamer1.0-x]Affected
Source package: [gst-plugins-base1.0]
Details (4)
- 1.22.0-3+deb12u6 · amd64 · bookworm
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
- 1.22.0-3+deb12u6 · arm64 · bookworm
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
- 1.22.0-3+deb12u6 · amd64 · bookworm-security
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
- 1.22.0-3+deb12u6 · arm64 · bookworm-security
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
[libgstreamer-gl1.0-0]Affected
Source package: [gst-plugins-base1.0]
Details (4)
- 1.22.0-3+deb12u6 · amd64 · bookworm
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
- 1.22.0-3+deb12u6 · arm64 · bookworm
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
- 1.22.0-3+deb12u6 · amd64 · bookworm-security
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
- 1.22.0-3+deb12u6 · arm64 · bookworm-security
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
[libgstreamer-plugins-base1.0-0]Affected
Source package: [gst-plugins-base1.0]
Details (4)
- 1.22.0-3+deb12u6 · amd64 · bookworm
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
- 1.22.0-3+deb12u6 · arm64 · bookworm
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
- 1.22.0-3+deb12u6 · amd64 · bookworm-security
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
- 1.22.0-3+deb12u6 · arm64 · bookworm-security
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
[libgstreamer-plugins-base1.0-dev]Affected
Source package: [gst-plugins-base1.0]
Details (4)
- 1.22.0-3+deb12u6 · amd64 · bookworm
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
- 1.22.0-3+deb12u6 · arm64 · bookworm
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
- 1.22.0-3+deb12u6 · amd64 · bookworm-security
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm
- 1.22.0-3+deb12u6 · arm64 · bookworm-security
  Affected
  nvd · gst-plugins-base1.0 · debian · bookworm

Observed: Oct 27, 2026, 4:45:22 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]