CVE-2026-3082

GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability

GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of Huffman tables. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28840.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Gstreamer

Products

Gstreamer

CVE-2026-3085

GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability

GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of X-QDM RTP payloads. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28851.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed

Vendors

Gstreamer

Products

Gstreamer

CVE-2026-31853

ImageMagick has a heap buffer over-write on 32-bit systems in SFW decoder

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-16 and 6.9.13-41, an overflow on 32-bit systems can cause a crash in the SFW decoder when processing extremely large images. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Imagemagick

Products

Imagemagick

CVE-2019-9928

GStreamer: heap-based buffer overflow in the RTSP connection parser via crafted server response leading to remote code execution

GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution.

CVSS 3.0 · 8.8 High EPSS 6.0% KEV · Not listed

Vendors

Canonical Debian Gstreamer

Products

Ubuntu Linux Debian Linux Gstreamer

CVE-2022-2122

gstreamer-plugins-good: Potential heap overwrite in mp4 demuxing using zlib decompression

DOS / potential heap overwrite in qtdemux using zlib decompression. Integer overflow in qtdemux element in qtdemux_inflate function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Gstreamer Redhat

Products

Debian Linux Gstreamer Enterprise Linux

CVE-2023-44429

GStreamer AV1 Codec Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GStreamer AV1 Codec Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of AV1 encoded video files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22226.

CVSS 3.1 · 8.8 High EPSS 1.8% KEV · Not listed

Vendors

Gstreamer Redhat

Products

Gstreamer Enterprise Linux Rhel Eus

CVE-2016-9445

gstreamer-plugins-bad-free: Integer overflow when allocating render buffer in VMnc decoder

Integer overflow in the vmnc decoder in the gstreamer allows remote attackers to cause a denial of service (crash) via large width and height values, which triggers a buffer overflow.

CVSS 3.1 · 7.5 High EPSS 4.8% KEV · Not listed

Vendors

Gstreamer Redhat

Products

Gstreamer Enterprise Linux

CVE-2022-1924

gstreamer-plugins-good: Potential heap overwrite in mkv demuxing using lzo decompression

DOS / potential heap overwrite in mkv demuxing using lzo decompression. Integer overflow in matroskademux element in lzo decompression function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap overwrite.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Gstreamer Redhat

Products

Debian Linux Gstreamer Enterprise Linux

CVE-2022-1923

gstreamer-plugins-good: Potential heap overwrite in mkv demuxing using bz2 decompression

DOS / potential heap overwrite in mkv demuxing using bzip decompression. Integer overflow in matroskademux element in bzip decompression function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap overwrite.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Gstreamer Redhat

Products

Debian Linux Gstreamer Enterprise Linux

CVE-2022-1922

gstreamer-plugins-good: Potential heap overwrite in mkv demuxing using zlib decompression

DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux element in gst_matroska_decompress_data function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap overwrite.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Gstreamer Redhat

Products

Debian Linux Gstreamer Enterprise Linux

CVE-2022-1925

gstreamer-plugins-good: Potential heap overwrite in mkv demuxing using HEADERSTRIP decompression

DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in matroskaparse element in gst_matroska_decompress_data function which causes a heap overflow. Due to restrictions on chunk sizes in the matroskademux element, the overflow can't be triggered, however the matroskaparse element has no size checks.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Gstreamer Redhat

Products

Debian Linux Gstreamer Enterprise Linux

CVE-2022-1920

gstreamer-plugins-good: Potential heap overwrite in gst_matroska_demux_add_wvpk_header()

Integer overflow in matroskademux element in gst_matroska_demux_add_wvpk_header function which allows a heap overwrite while parsing matroska files. Potential for arbitrary code execution through heap overwrite.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Gstreamer Redhat

Products

Debian Linux Gstreamer Enterprise Linux

CVE-2023-37329

GStreamer SRT File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GStreamer SRT File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of SRT subtitle files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20968.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed

Vendors

Gstreamer

Products

Gstreamer

CVE-2023-37328

GStreamer PGS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GStreamer PGS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of PGS subtitle files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-20994.

CVSS 3.1 · 8.8 High EPSS 2.1% KEV · Not listed

Vendors

Gstreamer Redhat

Products

Gstreamer Enterprise Linux

CVE-2025-62405

Heap-based Buffer Overflow Vulnerability in TP-Link Archer AX53

Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault or potentially execute arbitrary code via a specially crafted network packet containing a field whose length exceeds the maximum expected value.This issue affects Archer AX53 v1.0: through 1.3.1 Build 20241120.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Tp-link

Products

Archer Ax53 Archer Ax53 Firmware

CVE-2025-62404

Heap-based Buffer Overflow Vulnerability in TP-Link Archer AX53

Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault or potentially execute arbitrary code via a specially crafted network packet whose length exceeds the maximum expected value.This issue affects Archer AX53 v1.0: through 1.3.1 Build 20241120.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Tp-link

Products

Archer Ax53 Archer Ax53 Firmware

CVE-2025-61983

Heap-based Buffer Overflow Vulnerability in TP-Link Archer AX53

Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault or potentially execute arbitrary code via a specially crafted network packet containing an excessive number of fields with zero‑length values.This issue affects Archer AX53 v1.0: through 1.3.1 Build 20241120.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Tp-link

Products

Archer Ax53 Archer Ax53 Firmware

CVE-2025-61944

Heap-based Buffer Overflow Vulnerability in TP-Link Archer AX53

Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault or potentially execute arbitrary code via a specially crafted network packet containing an excessive number of fields with zero‑length values.This issue affects Archer AX53 v1.0: through 1.3.1 Build 20241120.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Tp-link

Products

Archer Ax53 Archer Ax53 Firmware

CVE-2025-59487

Heap-based Buffer Overflow Vulnerability in TP-Link Archer AX53

Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault or potentially execute arbitrary code. The vulnerability arises from improper validation of a packet field whose offset is used to determine the write location in memory. By crafting a packet with a manipulated field offset, an attacker can redirect writes to arbitrary memory locations.This issue affects Archer AX53 v1.0: through 1.3.1 Build 20241120.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Tp-link

Products

Archer Ax53 Archer Ax53 Firmware

CVE-2025-59482

Heap-based Buffer Overflow Vulnerability in TP-Link Archer AX53

Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault or potentially execute arbitrary code via a specially crafted network packet containing a field whose length exceeds the maximum expected value.This issue affects Archer AX53 v1.0: through 1.3.1 Build 20241120.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Tp-link

Products

Archer Ax53 Archer Ax53 Firmware