CVE-2026-2923
- Source
- https://cve.org/CVERecord?id=CVE-2026-2923
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2923.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-2923
- Downstream
CLSA (1)
DEBIAN (1)
MGASA (1)
MINI (1)
OESA (2)
RHSA (7)
UBUNTU (1)
- Related
- Published
- 2026-03-13T20:39:01Z
- Modified
- 2026-10-22T07:28:34Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- GStreamer DVB Subtitles Out-Of-Bounds Write Remote Code Execution Vulnerability
- Details
-
GStreamer DVB Subtitles Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the handling of coordinates. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28838.
- Database specific
{ "cna_assigner": "zdi", "cwe_ids": [ "CWE-787" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2923.json" }- References
-
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2923.json
- https://access.redhat.com/errata/RHSA-2026:19024
- https://access.redhat.com/errata/RHSA-2026:19180
- https://access.redhat.com/errata/RHSA-2026:6259
- https://access.redhat.com/errata/RHSA-2026:6300
- https://access.redhat.com/errata/RHSA-2026:6750
- https://access.redhat.com/errata/RHSA-2026:8854
- https://access.redhat.com/errata/RHSA-2026:8862
- https://access.redhat.com/security/cve/CVE-2026-2923
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2923.json
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/3b8253f447bcc9831dbf643d2c69b205fedbe086
- https://nvd.nist.gov/vuln/detail/CVE-2026-2923
- https://www.zerodayinitiative.com/advisories/ZDI-26-161/
- https://bugzilla.redhat.com/show_bug.cgi?id=2447503
Affected packages
Git / gitlab.freedesktop.org/gstreamer/gstreamer
Affected ranges
- Type
- GIT
- Repo
- https://gitlab.freedesktop.org/gstreamer/gstreamer
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "1c6e163aa33962f5ee4a87d29319ccdd5cb67612" }, { "last_affected": "1c6e163aa33962f5ee4a87d29319ccdd5cb67612" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "fixed": "3b8253f447bcc9831dbf643d2c69b205fedbe086" } ], "source": "REFERENCES_COMMIT" } ] }
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2923.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"88509630988559440288017817459783572444",
"161492070524781027918803299839300537733",
"95940441084868425017144949365656191654",
"176469428776325978617280013257309665356",
"244672894378666749135053040719644820244",
"221844690268919236382923352920440360125",
"35558301871778187848715120134665634366",
"171348326882516806382448515431209904294",
"76439546031843848497292442452939042555",
"205655252708485721522979677822876102785",
"253107649395994768661591827007101812650",
"292505454661135620150501959248019234695",
"78526808942719236464760353851867253536",
"132625317024175395646513195198276597065",
"152627087340308826459906683599146144657",
"7862491561330321303041030449303588437",
"221286968218854267295000241304231394563",
"219039615484399534435939521026156474869",
"164495320867954403861758582536416069561",
"23640356570274031236789724488556349140",
"137989284984781670840096312707847277621",
"18099131300711179596300539055283072583",
"37448561280541226046637920798191033481",
"228235648282631466342758327927277080866",
"193001799661191916342344940143733214085",
"83031682098212659464568120317621415039",
"156700179210796120846606552767921412805",
"296707064875155706133832149502009425631",
"26829759538844010670950034827297185998",
"71207740858201184702995579907003780756",
"90816470097209850941541684176571354737",
"316015519142027397918489776836822638268",
"20253938363727520947583099138071862458",
"323487439429925366741454680965189413792",
"33118516881054582406116863629016122771",
"158636721048303222630672401647383077751",
"269928796186876071426892606903566756047",
"205767546921755425653791921233614338096",
"254189561715371912872271755173155784437",
"141352782153029588075823763319986147501",
"69797610292476266121297700936746886024",
"99871441478060969218493938638685813004",
"25789979642075600009201923191837784921",
"162651513148491984504761516889805193745",
"299915686298596651669050864586939286010",
"94160134439762184163567743416004444084",
"178994293512719745414793760833947438069",
"325107651062990400987862396018188261754",
"96232291789133276615952797806432292431",
"139581033656534985466238641944212945051",
"192328522543459247557122628468663367993",
"206814828724175603200631877536987601140",
"273796379189557744972576159770883670037",
"15445324026596178665987593914221023526",
"201806055543837117302886737335613320311",
"276139480699084563992022822671039152743",
"139062191816520155839444766155374042804",
"260415448303964380856501830746482475622",
"163379959204166507138983862923038525943",
"280843361019959023021941702298122017596",
"137015583049504591049566168852179178413",
"173295355981683529042826468728101464629",
"112756397164312050071715200497839713045",
"193001799661191916342344940143733214085",
"83031682098212659464568120317621415039",
"156700179210796120846606552767921412805",
"180789735683032894415224477169101549115",
"236227857565836111708816666585157549719",
"63003923754976785199249318729892848725",
"193986700647995273937672400068402847808",
"316015519142027397918489776836822638268",
"20253938363727520947583099138071862458",
"52792312314765776066331523893185012496",
"196172738104675701619638086245556743591",
"191247399505364619513101630360865703982",
"73184608137412825466281164087954241783",
"124790096448719211140666412412482877897",
"244068526113817271852478860358820169249",
"275981425879806539462171162313127872851",
"3789507016577749477863248174326655667",
"51329058218926211002962517627921484670",
"277046336054839374798842334912135685244",
"89880672408205048644461081047614362906",
"75945140843841342474540085705953443299",
"193572488631385463843725977077578124029",
"11230513972038721396164475424291465878",
"115881098946983069181461516401239208397",
"11197927368260163314724480129367776351",
"299915686298596651669050864586939286010",
"275443490946953349771293146819773499941",
"178994293512719745414793760833947438069",
"40592118855272772786990398438047237299",
"295841865686170669205334056951268725685",
"85964986042491716146968073376103942264",
"277679051849877933188453302064486770661",
"258583987760830702087158120096179888499",
"166616616542068356526487348878677027441",
"56194943340287629832378584772832128219",
"118533959226614468642495741544081412158",
"25176078237710101182445458883128509241",
"72421923446707680286900857638935872710",
"260415448303964380856501830746482475622",
"63446175228471881612144856854631633900",
"65645961209097386067010561064589769130",
"143140112627089824921245133871540017277",
"206832613243938519693524849842263144371",
"24895966997565794564002318982339107521",
"193001799661191916342344940143733214085",
"83031682098212659464568120317621415039",
"156700179210796120846606552767921412805",
"64776977886729040027353045934331359462",
"169245719844424311298323797411005179813",
"214104274608147871400565952849106336533",
"150475098154668200900956716356723571240",
"316015519142027397918489776836822638268",
"20253938363727520947583099138071862458",
"52792312314765776066331523893185012496",
"263585414825353777084290177955014567378",
"36691586866934423636365032717376807297",
"104835841576635334973452394253841255400",
"332303421497538377893847888705585955116",
"212656038756240914771846512849099602390",
"141127709631587333711901462401374283273",
"272688257182879776907521260753369633073",
"237703539247680349384787667174362404420",
"302625987876846416118919207583742640609",
"122539639185211426945599687330604777227",
"322666031428802316631185226660798212916",
"188484620012721297657638116415676927279",
"168291089524996823275195317508518828789",
"251281561870456493031352029579000317293",
"112757191536748428909621515310930724401",
"157364110656859031916050550982771695415",
"47200949761371602426144793019890442262",
"14151707077548076154053144513458370264",
"198241987639874688103248711881140582500",
"69273063157944643118827517132765983023",
"109910465399388423935289687637657680050",
"126317887143276664040394219111920607780",
"257348866655398003669633309426718283890",
"230515376701362152101850622276822313895",
"249421880199284530172081229089212776562",
"293699906942071766041570971751912221200",
"274172432624121590031881499517763686911",
"8669042285832564921491170570136997799",
"73799098679335869678629907416879451806",
"333702859412735351288561388865807120006",
"90739095752438221881288019675424357709",
"70289295559611391349440386216398471674",
"147785843693322309139933228850803753639",
"42934786267338745090081183099110194434",
"8463054799951106083916524692161605324",
"166073503955940221663219984806593759246",
"138843792091242242082618931555100884132",
"8669042285832564921491170570136997799",
"186657419367510616549379085314164049652",
"89476677902734689832191627857480112344",
"60129014752561729810309122718255191509",
"105507136196289857458828565028878727526",
"173417012760076037679260529291602899555",
"209649572768957674432849257029582869826",
"305678700092421163007425543019465855830",
"282507326960804527920896421779548259066",
"336857932865304465792077042284814089818",
"163051272520967993722216959734961789459",
"73799098679335869678629907416879451806",
"333702859412735351288561388865807120006",
"90739095752438221881288019675424357709",
"41017275418814603595477475018143838530",
"215690492763531754591347850342397800630",
"144837570469707911495317620952520670449",
"144368942596348034409240668523915489334",
"183949162757088740063599807161389174287",
"318184103280009376296847338738628982249",
"318774167269095229392371860728758051596",
"265947575540539692708381968245525371461",
"309284553471259707178001071533379614566",
"298368605227330756512430259809473063213",
"3116595960677313351929352532390548572",
"330420306911899068443044492433432555464",
"277579359604750588079845818639244011475",
"72208444543425412375495805106654843629",
"298658688290865121390716523127985516263",
"202628181416463992080031183847040887623",
"281080305652480733228631040333092926564",
"120080526643708674282000303018747675664",
"79575100319993844142534408419047508001",
"327792205446761091902328592064852095777",
"335534907315771663790622580890142702153",
"56167960708856005813553972952267156764",
"84478693286414826197733128314255985877"
],
"threshold": 0.9
},
"id": "CVE-2026-2923-15bd2327",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://gitlab.freedesktop.org/gstreamer/gstreamer@3b8253f447bcc9831dbf643d2c69b205fedbe086",
"target": {
"file": "subprojects/gst-plugins-bad/gst/dvbsuboverlay/dvb-sub.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "80520085186631657618328970649418221928",
"length": 1310
},
"id": "CVE-2026-2923-24f4a885",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://gitlab.freedesktop.org/gstreamer/gstreamer@3b8253f447bcc9831dbf643d2c69b205fedbe086",
"target": {
"file": "subprojects/gst-plugins-bad/gst/dvbsuboverlay/dvb-sub.c",
"function": "_dvb_sub_parse_object_segment"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "307471870222719027115410191965072688014",
"length": 1174
},
"id": "CVE-2026-2923-3e0e57ec",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://gitlab.freedesktop.org/gstreamer/gstreamer@3b8253f447bcc9831dbf643d2c69b205fedbe086",
"target": {
"file": "subprojects/gst-plugins-bad/gst/dvbsuboverlay/dvb-sub.c",
"function": "_dvb_sub_read_8bit_string"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "301701878148743377785593418920701116993",
"length": 1534
},
"id": "CVE-2026-2923-4a5fffa3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://gitlab.freedesktop.org/gstreamer/gstreamer@3b8253f447bcc9831dbf643d2c69b205fedbe086",
"target": {
"file": "subprojects/gst-plugins-bad/gst/dvbsuboverlay/dvb-sub.c",
"function": "_dvb_sub_read_4bit_string"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "80340366577501165084854690316119093622",
"length": 3379
},
"id": "CVE-2026-2923-a3d94875",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://gitlab.freedesktop.org/gstreamer/gstreamer@3b8253f447bcc9831dbf643d2c69b205fedbe086",
"target": {
"file": "subprojects/gst-plugins-bad/gst/dvbsuboverlay/dvb-sub.c",
"function": "_dvb_sub_parse_pixel_data_block"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "65676625540122018386282799821579057533",
"length": 1352
},
"id": "CVE-2026-2923-a6b95590",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://gitlab.freedesktop.org/gstreamer/gstreamer@3b8253f447bcc9831dbf643d2c69b205fedbe086",
"target": {
"file": "subprojects/gst-plugins-bad/gst/dvbsuboverlay/dvb-sub.c",
"function": "_dvb_sub_parse_clut_segment"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "238935800732324558105533063564905861610",
"length": 1371
},
"id": "CVE-2026-2923-c62e008d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://gitlab.freedesktop.org/gstreamer/gstreamer@3b8253f447bcc9831dbf643d2c69b205fedbe086",
"target": {
"file": "subprojects/gst-plugins-bad/gst/dvbsuboverlay/dvb-sub.c",
"function": "_dvb_sub_read_2bit_string"
}
}
]
vanir_signatures_modified
"2026-10-22T07:28:34Z"