CVE-2026-86476 — Red Hat
HIGHCVE-2026-86476 is a high-severity (CVSS 8.4) Out-of-bounds Write vulnerability. No vendor fix is recorded yet; mitigation options are listed below.
A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that…
Description
A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-checked during deserialization, and the video frame mapping code does not verify that the declared plane geometry fits within the buffer before allowing consumers to read or write video data. A local attacker who controls the sending side of a GStreamer inter-process IPC pipeline can deliver a crafted buffer carrying fabricated strides, causing the receiving process to read or write beyond heap boundaries. Successful exploitation can cause a denial of service or potentially allow code execution within the affected process.
Detection & mitigation playbook
VulnerabilityDetect
Identify every host running the affected component and compare the installed build against the fixed version below — for source-built or distro-packaged software the version string, not a lockfile, is the source of truth (`dpkg -l`, `rpm -q`, or the binary's own `--version`).
Remediation status
No fixed release is recorded for CVE-2026-86476 yet. Track the upstream advisory, and apply the exposure-reduction steps below in the meantime.
Mitigate without a patch
Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
Red Hat is evaluating product impact for gst-plugins-base (libgstvideo) across supported streams. Upstream has confirmed the issue is valid and expects a fix in GStreamer 1.28.8 (target approximately October 2026). Coordinated public disclosure date is pending confirmation from upstream. The practical cross-process…
If inter-process video sharing via unixfd is not required, build or deploy GStreamer without the unixfd plugin (for example meson option -Dgst-plugins-bad:unixfd=disabled, or omit libgstunixfd.so from the GStreamer plugin directory). Upstream confirms this is the only practical mitigation for the cross-process attack path and notes the unixfd plugin is not currently used by Red Hat-packaged or major distribution software. Operational policy to avoid connecting receiver pipelines to Unix socket endpoints controlled by untrusted local processes provides equivalent protection without rebuilding. This does not address the underlying validation gap in libgstvideo when attacker-controlled…Source: Red Hat security advisory for CVE-2026-86476 (CC BY 4.0)
Frequently Asked Questions
Is CVE-2026-86476 in your dependencies?
Find it across , including transitive dependencies.