Description (CNA)
A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a RealMedia file containing a specially crafted FILEINFO metadata section, the demuxer parses variable-name and variable-value pairs using re_skip_pascal_string() without validating that offsets remain within the mapped buffer. Additionally, the element count controlling the parsing loop is read from attacker-controlled data without validation, which can cause an infinite loop. A crafted RealMedia file can cause the application to crash, hang, or potentially read limited adjacent memory contents.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Red Hat / Red Hat Enterprise Linux 10 | unaffected 0:1.26.7-2.el10_2.1 before * |
| Red Hat / Red Hat Enterprise Linux 10.0 Extended Update Support | unaffected 0:1.24.11-1.el10_0.2 before * |
| Red Hat / Red Hat Enterprise Linux 9 | unaffected 0:1.22.12-6.el9_8.1 before * |
| Red Hat / Red Hat Enterprise Linux 9.6 Extended Update Support | unaffected 0:1.22.12-4.el9_6.1 before * |
| Red Hat / Red Hat Enterprise Linux 7 | unaffected |
| Red Hat / Red Hat Enterprise Linux 8 | unaffected |
CWE
CWE-125
References
- https://access.redhat.com/errata/RHSA-2026:36673
- https://access.redhat.com/errata/RHSA-2026:36674
- https://access.redhat.com/errata/RHSA-2026:50688
- https://access.redhat.com/errata/RHSA-2026:50691
- https://access.redhat.com/security/cve/CVE-2026-53704
- https://bugzilla.redhat.com/show_bug.cgi?id=2487614
ADP enrichment
No English description supplied.
No references supplied.