Skip to content

CVE-2026-53704 on CTRL-OS 26.05

Aliases: CVE-2026-53704

Packages: gst_all_1.gst-plugins-ugly

Status: Plausible

Advisory Information

A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a RealMedia file containing a specially crafted FILEINFO metadata section, the demuxer parses variable-name and variable-value pairs using re_skip_pascal_string() without validating that offsets remain within the mapped buffer. Additionally, the element count controlling the parsing loop is read from attacker-controlled data without validation, which can cause an infinite loop. A crafted RealMedia file can cause the application to crash, hang, or potentially read limited adjacent memory contents.

Updates

2026-07-10 01:14 CEST

Metadata changes:

  • Status for package gst_all_1.gst-plugins-ugly: “Plausible”

(Amended on: 2026-07-10 01:15 CEST)

2026-07-06 23:08 CEST

Metadata changes:

  • Status for package gst_all_1.gst-plugins-ugly: “New”

(Amended on: 2026-07-06 23:09 CEST)