en
GStreamer is a global open-source multimedia project and software framework. It provides modular libraries, APIs, pipelines, and plugins for processing audio, video, and other data streams. The project is intended for developers building media players, recorders, editors, transcoders, streaming systems, and real-time communication applications.
As of 09/13/2026, GStreamer recorded 8 security vulnerabilities in the last 90 days across 2 products, including 6 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, GStreamer had the most security vulnerabilities in the GStreamer ecosystem, with 6 vulnerabilities—approximately 75% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-18299GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published08/20/2026 | SeverityHigh |
CVE-2026-18298GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published08/20/2026 | SeverityHigh |
CVE-2026-18297GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published08/20/2026 | SeverityHigh |
CVE-2026-18296GStreamer MRF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published08/20/2026 | SeverityHigh |
CVE-2026-18295GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published08/20/2026 | SeverityHigh |
CVE-2026-73433Gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux fujifilm strd parsing leading to out-of-bounds read/write | Exploitation statusNot known exploited | FixYes | Affected productgst-plugins-good | Published08/12/2026 | SeverityMedium |
CVE-2026-73434Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing | Exploitation statusNot known exploited | FixYes | Affected productgst-plugins-good | Published08/12/2026 | SeverityMedium |
CVE-2026-5056GStreamer qtdemux Stack-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published07/29/2026 | SeverityHigh |
CVE-2026-12892Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad: 1-byte heap out-of-bounds read in h.264 nal extension slice parser | Exploitation statusNot known exploited | FixNot confirmed | Affected productRed Hat Enterprise Linux 10 | Published06/23/2026 | SeverityMedium |
CVE-2026-12891Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad: global buffer overflow (oob read) in h.266/vvc vui parameter parser | Exploitation statusNot known exploited | FixNot confirmed | Affected productRed Hat Enterprise Linux 10 | Published06/23/2026 | SeverityMedium |
CVE-2026-46470 | Exploitation statusNot known exploited | FixYes | Affected productGood Plug-ins | Published05/14/2026 | SeverityMedium |
CVE-2026-46469 | Exploitation statusNot known exploited | FixYes | Affected productGood Plug-ins | Published05/14/2026 | SeverityMedium |
CVE-2026-1940Gstreamer: incomplete fix of cve-2026-1940 | Exploitation statusNot known exploited | FixNot confirmed | Affected productRed Hat Enterprise Linux 10 | Published03/23/2026 | SeverityMedium |
CVE-2026-3084GStreamer H.266 Codec Parser Integer Underflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published03/13/2026 | SeverityHigh |
CVE-2026-2921GStreamer RIFF Palette Integer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published03/13/2026 | SeverityHigh |
CVE-2026-3083GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published03/13/2026 | SeverityHigh |
CVE-2026-3086GStreamer H.266 Codec Parser Out-Of-Bounds Write Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published03/13/2026 | SeverityHigh |
CVE-2026-3085GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published03/13/2026 | SeverityHigh |
CVE-2026-3082GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published03/13/2026 | SeverityHigh |
CVE-2026-3081GStreamer H.266 Codec Parser Stack-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published03/13/2026 | SeverityHigh |
CVE-2026-2923GStreamer DVB Subtitles Out-Of-Bounds Write Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published03/13/2026 | SeverityHigh |
CVE-2026-2922GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published03/13/2026 | SeverityHigh |
CVE-2026-2920GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published03/13/2026 | SeverityHigh |
CVE-2025-47183 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published08/07/2025 | SeverityMedium |
CVE-2025-47219 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published08/07/2025 | SeverityHigh |
CVE-2025-47806 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published08/07/2025 | SeverityMedium |
CVE-2025-47807 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published08/07/2025 | SeverityMedium |
CVE-2025-47808 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published08/07/2025 | SeverityMedium |
CVE-2025-6663GStreamer H266 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published07/07/2025 | SeverityHigh |
CVE-2025-2759GStreamer Incorrect Permission Assignment Local Privilege Escalation Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published05/22/2025 | SeverityHigh |
CVE-2025-3887GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published05/22/2025 | SeverityHigh |
CVE-2024-47834GHSL-2024-280: Gstreamer Use-After-Free read in Matroska CodecPrivate | Exploitation statusPublic exploit | FixYes | Affected productGStreamer | Published12/11/2024 | SeverityMedium |
CVE-2024-47835GHSL-2024-263: Gstreamer NULL-pointer dereference in LRC subtitle parser | Exploitation statusPublic exploit | FixYes | Affected productGStreamer | Published12/11/2024 | SeverityMedium |
CVE-2024-47778GHSL-2024-258: GStreamer has an OOB-read in gst_wavparse_adtl_chunk | Exploitation statusPublic exploit | FixYes | Affected productGStreamer | Published12/11/2024 | SeverityMedium |
CVE-2024-47777GHSL-2024-259: GStreamer has an OOB-read in gst_wavparse_smpl_chunk | Exploitation statusPublic exploit | FixYes | Affected productGStreamer | Published12/11/2024 | SeverityMedium |
CVE-2024-47776GHSL-2024-260: GStreamer has a OOB-read in gst_wavparse_cue_chunk | Exploitation statusPublic exploit | FixYes | Affected productGStreamer | Published12/11/2024 | SeverityMedium |
CVE-2024-47775GHSL-2024-261: GStreamer has an OOB-read in parse_ds64 | Exploitation statusPublic exploit | FixYes | Affected productGStreamer | Published12/11/2024 | SeverityMedium |
CVE-2024-47774GHSL-2024-262: GStreamer has an OOB-read in gst_avi_subtitle_parse_gab2_chunk | Exploitation statusNot known exploited | FixYes | Affected productGStreamer | Published12/11/2024 | SeverityMedium |
CVE-2024-47613GHSL-2024-118: GStreamer has a null pointer dereference in gst_gdk_pixbuf_dec_flush | Exploitation statusPublic exploit | FixYes | Affected productGStreamer | Published12/11/2024 | SeverityHigh |
CVE-2024-47615GHSL-2024-117: GStreamer has an out-of-bounds write in Ogg demuxer | Exploitation statusPublic exploit | FixYes | Affected productGStreamer | Published12/11/2024 | SeverityHigh |
CVE-2024-47607GHSL-2024-116: Stack-buffer overflow in gst_opus_dec_parse_header | Exploitation statusPublic exploit | FixYes | Affected productGStreamer | Published12/11/2024 | SeverityHigh |
CVE-2024-47606GHSL-2024-166: GStreamer Integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes | Exploitation statusNot known exploited | FixYes | Affected productGStreamer | Published12/11/2024 | SeverityHigh |
CVE-2024-47603GHSL-2024-251: GStreamer NULL-pointer dereference in Matroska/WebM demuxer | Exploitation statusPublic exploit | FixYes | Affected productGStreamer | Published12/11/2024 | SeverityMedium |
CVE-2024-47602GHSL-2024-250: Streamer NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer | Exploitation statusPublic exploit | FixYes | Affected productGStreamer | Published12/11/2024 | SeverityMedium |
CVE-2024-47601GHSL-2024-249: GStreamer has a NULL-pointer dereference in Matroska/WebM demuxer | Exploitation statusPublic exploit | FixYes | Affected productGStreamer | Published12/11/2024 | SeverityMedium |
CVE-2024-47600GHSL-2024-248: GStreamer has an OOB-read in format_channel_mask | Exploitation statusPublic exploit | FixYes | Affected productGStreamer | Published12/11/2024 | SeverityMedium |
CVE-2024-47599GHSL-2024-247: GStreamer Insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences | Exploitation statusPublic exploit | FixYes | Affected productGStreamer | Published12/11/2024 | SeverityMedium |
CVE-2024-47598GHSL-2024-246: GStreamer has an OOB-read in qtdemux_merge_sample_table | Exploitation statusPublic exploit | FixYes | Affected productGStreamer | Published12/11/2024 | SeverityMedium |
CVE-2024-47597GHSL-2024-245: GStreamer has an OOB-read in qtdemux_parse_samples | Exploitation statusPublic exploit | FixYes | Affected productGStreamer | Published12/11/2024 | SeverityMedium |
CVE-2024-47596GHSL-2024-244: GStreamer has an OOB-read in FOURCC_SMI_ parsing | Exploitation statusPublic exploit | FixYes | Affected productGStreamer | Published12/11/2024 | SeverityMedium |
CVE-2024-47546GHSL-2024-243: GStreamer has an integer underflow in extract_cc_from_data leading to OOB-read | Exploitation statusPublic exploit | FixYes | Affected productGStreamer | Published12/11/2024 | SeverityMedium |
CVE-2024-47545GHSL-2024-242: GStreamer has an integer underflow in FOURCC_strf parsing leading to OOB-read | Exploitation statusPublic exploit | FixYes | Affected productGStreamer | Published12/11/2024 | SeverityMedium |
CVE-2024-47544GHSL-2024-238: GStreamer has NULL-pointer dereferences in MP4/MOV demuxer CENC handling | Exploitation statusNot known exploited | FixYes | Affected productGStreamer | Published12/11/2024 | SeverityMedium |
CVE-2024-47543GHSL-2024-236: GStreamer has an OOB-read in qtdemux_parse_container | Exploitation statusPublic exploit | FixYes | Affected productGStreamer | Published12/11/2024 | SeverityMedium |
CVE-2024-47542GHSL-2024-235: GStreamer ID3v2 parser out-of-bounds read and NULL-pointer dereference | Exploitation statusPublic exploit | FixYes | Affected productGStreamer | Published12/11/2024 | SeverityMedium |
CVE-2024-47541GHSL-2024-228: GStreamer has an out-of-bounds write in SSA subtitle parser | Exploitation statusPublic exploit | FixYes | Affected productGStreamer | Published12/11/2024 | SeverityMedium |
CVE-2024-47540GHSL-2024-197: GStreamer uses uninitialized stack memory in Matroska/WebM demuxer | Exploitation statusPublic exploit | FixYes | Affected productGStreamer | Published12/11/2024 | SeverityHigh |
CVE-2024-47539GHSL-2024-195: GStreamer has an OOB-write in convert_to_s334_1a | Exploitation statusPublic exploit | FixYes | Affected productGStreamer | Published12/11/2024 | SeverityHigh |
CVE-2024-47538GHSL-2024-115: GStreamer has a stack-buffer overflow in vorbis_handle_identification_packet | Exploitation statusPublic exploit | FixYes | Affected productGStreamer | Published12/11/2024 | SeverityHigh |
CVE-2024-47537GHSL-2024-094: GStreamer has an OOB-write in isomp4/qtdemux.c | Exploitation statusNot known exploited | FixYes | Affected productGStreamer | Published12/11/2024 | SeverityHigh |
CVE-2024-40897 | Exploitation statusNot known exploited | FixNot confirmed | Affected productORC | Published07/26/2024 | SeverityHigh |
CVE-2024-0444GStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published06/07/2024 | SeverityHigh |
CVE-2024-4453GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published05/22/2024 | SeverityHigh |
CVE-2023-50186GStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published05/03/2024 | SeverityHigh |
CVE-2023-44446GStreamer MXF File Parsing Use-After-Free Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published05/03/2024 | SeverityHigh |
CVE-2023-44429GStreamer AV1 Codec Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published05/03/2024 | SeverityHigh |
CVE-2023-40476GStreamer H265 Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published05/03/2024 | SeverityHigh |
CVE-2023-40475GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published05/03/2024 | SeverityHigh |
CVE-2023-40474GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published05/03/2024 | SeverityHigh |
CVE-2023-38104GStreamer RealMedia File Parsing Integer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published05/03/2024 | SeverityHigh |
CVE-2023-38103GStreamer RealMedia File Parsing Integer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published05/03/2024 | SeverityHigh |
CVE-2023-37329GStreamer SRT File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published05/03/2024 | SeverityHigh |
CVE-2023-37328GStreamer PGS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published05/03/2024 | SeverityHigh |
CVE-2023-37327GStreamer FLAC File Parsing Integer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published05/03/2024 | SeverityHigh |
CVE-2022-1924 | Exploitation statusNot confirmed | FixNot confirmed | Affected productGStreamer | Published07/19/2022 | SeverityUnknown |
CVE-2022-1923 | Exploitation statusNot confirmed | FixNot confirmed | Affected productGStreamer | Published07/19/2022 | SeverityUnknown |
CVE-2022-2122 | Exploitation statusNot confirmed | FixNot confirmed | Affected productGStreamer | Published07/19/2022 | SeverityUnknown |
CVE-2022-1925 | Exploitation statusNot confirmed | FixNot confirmed | Affected productGStreamer | Published07/19/2022 | SeverityUnknown |
CVE-2022-1922 | Exploitation statusNot confirmed | FixNot confirmed | Affected productGStreamer | Published07/19/2022 | SeverityUnknown |
CVE-2022-1920 | Exploitation statusNot confirmed | FixNot confirmed | Affected productGStreamer | Published07/19/2022 | SeverityUnknown |
CVE-2022-1921 | Exploitation statusNot confirmed | FixNot confirmed | Affected productGStreamer | Published07/19/2022 | SeverityUnknown |
CVE-2021-3522 | Exploitation statusNot known exploited | FixNot confirmed | Affected productGStreamer | Published06/02/2021 | SeverityMedium |
CVE-2021-3498 | Exploitation statusNot confirmed | FixNot confirmed | Affected productgstreamer-plugins-good | Published04/19/2021 | SeverityUnknown |
CVE-2021-3497 | Exploitation statusNot confirmed | FixNot confirmed | Affected productgstreamer-plugins-good | Published04/19/2021 | SeverityUnknown |
CVE-2019-9928 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/24/2019 | SeverityUnknown |
CVE-2016-10198 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/09/2017 | SeverityUnknown |
CVE-2017-5841 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/09/2017 | SeverityUnknown |
CVE-2017-5840 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/09/2017 | SeverityUnknown |
CVE-2017-5839 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/09/2017 | SeverityUnknown |
CVE-2016-10199 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/09/2017 | SeverityUnknown |
CVE-2017-5845 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/09/2017 | SeverityUnknown |
CVE-2017-5842 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/09/2017 | SeverityUnknown |
CVE-2017-5843 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/09/2017 | SeverityUnknown |
CVE-2017-5837 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/09/2017 | SeverityUnknown |
CVE-2017-5847 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/09/2017 | SeverityUnknown |
CVE-2017-5848 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/09/2017 | SeverityUnknown |
CVE-2017-5846 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/09/2017 | SeverityUnknown |
CVE-2017-5844 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/09/2017 | SeverityUnknown |
CVE-2017-5838 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/09/2017 | SeverityUnknown |
CVE-2016-9636 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2017 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
