{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3agstreamerlibgstvideo/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:gstreamer:libgstvideo:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.4,"id":"CVE-2026-86476"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["libgstvideo (GStreamer 1.28.4 and earlier)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","heap-overflow","memory-corruption"],"_cs_type":"advisory","_cs_vendors":["GStreamer"],"content_html":"\u003cp\u003eA heap buffer overflow vulnerability exists in the GStreamer \u003ccode\u003elibgstvideo\u003c/code\u003e component (specifically within \u003ccode\u003egst-plugins-base\u003c/code\u003e), identified as CVE-2026-86476. The vulnerability stems from insufficient validation of \u003ccode\u003eGstVideoMeta\u003c/code\u003e structures when deserialized from untrusted \u003ccode\u003eunixfd\u003c/code\u003e peers. Attackers can provide fabricated plane strides within the metadata, leading to out-of-bounds reads and writes during frame processing. Proof-of-concept code demonstrates that these primitives can be used for information disclosure or heap-based remote code execution by overwriting function pointers.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker establishes a connection with a target process over a \u003ccode\u003eunixfd\u003c/code\u003e transport.\u003c/li\u003e\n\u003cli\u003eThe attacker sends a serialized \u003ccode\u003eGstVideoMeta\u003c/code\u003e structure containing intentionally oversized or negative plane strides.\u003c/li\u003e\n\u003cli\u003eThe target receiver deserializes the malicious meta-data without performing range checks against the backing buffer size.\u003c/li\u003e\n\u003cli\u003eThe target process maps the frame, with \u003ccode\u003edefault_map()\u003c/code\u003e failing to validate the geometry against the actual memory allocation.\u003c/li\u003e\n\u003cli\u003eDuring subsequent processing (e.g., in \u003ccode\u003evideoconvert\u003c/code\u003e), the system performs \u003ccode\u003ememcpy\u003c/code\u003e or ORC kernel operations based on the attacker-controlled strides.\u003c/li\u003e\n\u003cli\u003eMemory operations occur outside the buffer boundaries, resulting in either a crash (read) or corruption of adjacent heap objects (write).\u003c/li\u003e\n\u003cli\u003eThe attacker leverages the write primitive to overwrite function pointers in a neighbouring \u003ccode\u003eGstMiniObject\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe application is triggered to call the corrupted pointer, redirecting control flow to attacker-supplied logic (e.g., \u003ccode\u003esystem()\u003c/code\u003e).\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eConfirmed impact includes out-of-bounds information disclosure and heap-based memory corruption. Demonstrations indicate potential for arbitrary code execution in pipelines that accept video buffers over \u003ccode\u003eunixfd\u003c/code\u003e from untrusted sources, particularly sandboxed decoders or portal-style privilege-boundary pipelines.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory systems utilizing GStreamer \u003ccode\u003eunixfdsrc\u003c/code\u003e elements, specifically those handling media frames across process or privilege boundaries.\u003c/li\u003e\n\u003cli\u003eApply security patches to GStreamer and dependent projects as soon as vendors release updates addressing the three validation points identified in the advisory: plane extent checks in \u003ccode\u003edefault_map()\u003c/code\u003e, validation in the meta branch of \u003ccode\u003egst_video_frame_map_id()\u003c/code\u003e, and range checks in \u003ccode\u003evideo_meta_deserialize()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eIsolate media processing pipelines that consume data from untrusted sources to minimize the impact of potential memory corruption.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-23T06:43:25Z","date_published":"2026-10-23T06:43:25Z","id":"https://feed.craftedsignal.io/briefs/2026-10-gstreamer-heap-overflow/","summary":"A heap buffer overflow in GStreamer's libgstvideo via untrusted unixfd deserialization allows remote attackers to trigger out-of-bounds memory access, potentially leading to code execution.","title":"GStreamer libgstvideo heap buffer overflow (CVE-2026-86476)","url":"https://feed.craftedsignal.io/briefs/2026-10-gstreamer-heap-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:gstreamer:libgstvideo:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}