GStreamer qtdemux Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of UncompressedFrameConfigBox structures. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29392.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-1e22d3b0bf advisory.

    Backport fix for CVE-2026-5056.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:49508 advisory.

    * gstreamer: GStreamer: Arbitrary code execution via stack-based buffer overflow in qtdemux     (CVE-2026-5056)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:49508 advisory.

    * gstreamer: GStreamer: Arbitrary code execution via stack-based buffer overflow in qtdemux     (CVE-2026-5056)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:49508 advisory.

    GStreamer is a streaming media framework based on graphs of filters which operate on media data. The     gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under     the LGPL license.

    Security Fix(es):

    * gstreamer: GStreamer: Arbitrary code execution via stack-based buffer overflow in qtdemux     (CVE-2026-5056)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-49508 advisory.

    [1.26.7-2.2]
    - Fix integer overflow and bounds check vulnerabilities in uncompressed       video handling (CVE-2026-5056)       Resolves: RHEL-222333

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6318 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6318-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     June 01, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : gst-plugins-good1.0     CVE ID         : CVE-2026-5056 CVE-2026-46469 CVE-2026-46470

    Multiple multiple vulnerabilities were discovered in plugins for     the GStreamer media framework and its codecs and demuxers, which     may result in denial of service or potentially the execution of     arbitrary code if a malformed media file is opened.

    For the stable distribution (trixie), these problems have been fixed in     version 1.26.2-1+deb13u1.

    We recommend that you upgrade your gst-plugins-good1.0 packages.

    For the detailed security status of gst-plugins-good1.0 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/gst-plugins-good1.0

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 05aadfcc-55f5-11f1-915c-8974b59277b5 advisory.

    The GStreamer project reports multiple security vulnerabilities fixed in the 1.28.2 release:
    Several security vulnerabilities were addressed, including:
    These could lead to application crashes, memory exhaustion, or potentially arbitrary code execution.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 25.10 host has packages installed that are affected by a vulnerability as referenced in the USN-8285-1 advisory.

    It was discovered that GStreamer Good Plugins incorrectly handled certain MOV/MP4 media files. A remote     attacker could use this issue to cause GStreamer Good Plugins to crash, resulting in a denial of service,     or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
334451	Fedora 43 : mingw-gstreamer1-plugins-good (2026-1e22d3b0bf)	Nessus	Fedora Local Security Checks	Local	high
332062	AlmaLinux 10 : gstreamer1-plugins-good (ALSA-2026:49508)	Nessus	Alma Linux Local Security Checks	Local	high
331929	RockyLinux 10 : gstreamer1-plugins-good (RLSA-2026:49508)	Nessus	Rocky Linux Local Security Checks	Local	high
331749	RHEL 10 : gstreamer1-plugins-good (RHSA-2026:49508)	Nessus	Red Hat Local Security Checks	Local	high
331721	Oracle Linux 10 : gstreamer1-plugins-good (ELSA-2026-49508)	Nessus	Oracle Linux Local Security Checks	Local	high
319494	Debian dsa-6318 : gstreamer1.0-gtk3 - security update	Nessus	Debian Local Security Checks	Local	critical
316658	FreeBSD : gstreamer1 -- multiple vulnerabilities (05aadfcc-55f5-11f1-915c-8974b59277b5)	Nessus	FreeBSD Local Security Checks	Local	critical
316042	Ubuntu 25.10 : GStreamer Good Plugins vulnerability (USN-8285-1)	Nessus	Ubuntu Local Security Checks	Local	critical

Detections

Analytics

CVE-2026-5056

high

Tenable Plugins

high

high

high

high

high

critical

critical

critical