A vulnerability was found in the GStreamer RealMedia demuxer (gst-plugins-ugly). When processing a RealMedia (.rm) file, the demuxer parses MDPR (media properties) chunks to configure audio streams. For audio stream header versions 4 and 5, the parser reads fields such as codec type, packet size, sample rate, channel count, and extra codec data length from fixed offsets within the chunk without first checking that the chunk contains enough data. If a malicious file provides an MDPR chunk that is too small to contain a complete audio stream header, the parser reads beyond the end of the buffer. This can cause the application to crash. In some cases, bytes read past the buffer boundary may be incorporated into stream metadata, which could result in limited information disclosure.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8896-1 advisory.

    Michael Randrianantenaina discovered that GStreamer's Ugly Plugins incorrectly handled certain malformed     RealMedia files. If a user were tricked into opening a crafted media file, an attacker could possibly use     this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu     20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-38103, CVE-2023-38104)

    It was discovered that GStreamer's Ugly Plugins incorrectly handled certain malformed ASF and RealMedia     files. If a user were tricked into opening a crafted media file, an attacker could possibly use this issue     to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS     and Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-2920, CVE-2026-2922)

    Tianshuo Han discovered that GStreamer's Ugly Plugins incorrectly handled certain malformed RealMedia     files. If a user were tricked into opening a crafted media file, an attacker could possibly use this issue     to cause a denial of service or expose sensitive information. (CVE-2026-53703, CVE-2026-53704)

    Seonwook Kim discovered that GStreamer's Ugly Plugins incorrectly handled certain malformed ASF files. If     a user were tricked into opening a crafted media file, an attacker could possibly use this issue to cause     a denial of service or expose sensitive information. (CVE-2026-19389)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784107571 advisory.

  - A vulnerability was found in the GStreamer RealMedia demuxer (gst-plugins-ugly). When processing a     RealMedia (.rm) file, the demuxer parses MDPR (media properties) chunks to configure audio streams. For     audio stream header versions 4 and 5, the parser reads fields such as codec type, packet size, sample     rate, channel count, and extra codec data length from fixed offsets within the chunk without first     checking that the chunk contains enough data. If a malicious file provides an MDPR chunk that is too small     to contain a complete audio stream header, the parser reads beyond the end of the buffer. This can cause     the application to crash. In some cases, bytes read past the buffer boundary may be incorporated into     stream metadata, which could result in limited information disclosure. (CVE-2026-53703)

  - A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a     RealMedia file containing a specially crafted FILEINFO metadata section, the demuxer parses variable-name     and variable-value pairs using re_skip_pascal_string() without validating that offsets remain within the     mapped buffer. Additionally, the element count controlling the parsing loop is read from attacker-     controlled data without validation, which can cause an infinite loop. A crafted RealMedia file can cause     the application to crash, hang, or potentially read limited adjacent memory contents. (CVE-2026-53704)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784107571 advisory.

  - A vulnerability was found in the GStreamer RealMedia demuxer (gst-plugins-ugly). When processing a     RealMedia (.rm) file, the demuxer parses MDPR (media properties) chunks to configure audio streams. For     audio stream header versions 4 and 5, the parser reads fields such as codec type, packet size, sample     rate, channel count, and extra codec data length from fixed offsets within the chunk without first     checking that the chunk contains enough data. If a malicious file provides an MDPR chunk that is too small     to contain a complete audio stream header, the parser reads beyond the end of the buffer. This can cause     the application to crash. In some cases, bytes read past the buffer boundary may be incorporated into     stream metadata, which could result in limited information disclosure. (CVE-2026-53703)

  - A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a     RealMedia file containing a specially crafted FILEINFO metadata section, the demuxer parses variable-name     and variable-value pairs using re_skip_pascal_string() without validating that offsets remain within the     mapped buffer. Additionally, the element count controlling the parsing loop is read from attacker-     controlled data without validation, which can cause an infinite loop. A crafted RealMedia file can cause     the application to crash, hang, or potentially read limited adjacent memory contents. (CVE-2026-53704)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_36674 advisory.

    * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header     parser (CVE-2026-53703)

    * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer FILEINFO metadata     parser (CVE-2026-53704)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2026_36673 advisory.

    * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header     parser (CVE-2026-53703)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1481:01 advisory.

    * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header     parser (CVE-2026-53703)
      * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer FILEINFO metadata     parser (CVE-2026-53704)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:50688 advisory.

    GStreamer is a streaming media framework, based on graphs of elements which operate on media data.  This     package contains plug-ins whose license is not fully compatible with LGPL.

    Security Fix(es):

    * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header     parser (CVE-2026-53703)

    * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer FILEINFO metadata     parser (CVE-2026-53704)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:50691 advisory.

    GStreamer is a streaming media framework, based on graphs of elements which operate on media data.  This     package contains plug-ins whose license is not fully compatible with LGPL.

    Security Fix(es):

    * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header     parser (CVE-2026-53703)

    * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer FILEINFO metadata     parser (CVE-2026-53704)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:36673 advisory.

    * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header     parser (CVE-2026-53703)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-36673 advisory.

    [1.26.7-2.1]
    - Fix CVE-2026-53703: multiple security issues in rmdemux       Resolves: RHEL-184439

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:36674 advisory.

    * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header     parser (CVE-2026-53703)

    * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer FILEINFO metadata     parser (CVE-2026-53704)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:36673 advisory.

    * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header     parser (CVE-2026-53703)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of GStreamer installed on the remote host is prior to 1.28.4. It is, therefore, affected by multiple vulnerabilities:

  - Multiple vulnerabilities were found in the RealMedia demuxer (rmdemux) and RealAudio demuxer (rademux)     elements in gst-plugins-ugly. The demuxers lacked proper bounds validation when parsing file headers,     stream properties, and audio packets, allowing out-of-bounds reads beyond the boundaries of the provided     data buffers. Additionally, the use of signed integer types for size and length parameters could lead to     integer overflows during size calculations and index operations. A malicious third party could trigger     out-of-bounds reads or integer overflows by providing a crafted RealMedia file, potentially resulting in     a crash, denial of service, or information disclosure. (CVE-2026-53703, CVE-2026-53704)

  - A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially     crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels)     in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes     decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects     both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to     the allocation size type. A remote attacker could use this flaw to crash an application or potentially     execute arbitrary code by convincing a user to open a malicious WavPack audio file. (CVE-2026-53705)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:36674 advisory.

    * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header     parser (CVE-2026-53703)
      * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer FILEINFO metadata     parser (CVE-2026-53704)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-36674 advisory.

    - Fix CVE-2026-53704: multiple rmdemux security issues

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:36674 advisory.

    GStreamer is a streaming media framework, based on graphs of elements which operate on media data.  This     package contains plug-ins whose license is not fully compatible with LGPL.

    Security Fix(es):

    * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header     parser (CVE-2026-53703)

    * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer FILEINFO metadata     parser (CVE-2026-53704)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:36673 advisory.

    GStreamer is a streaming media framework, based on graphs of elements which operate on media data.  This     package contains plug-ins whose license is not fully compatible with LGPL.

    Security Fix(es):

    * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header     parser (CVE-2026-53703)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 4e82a0e6-6801-42c6-8fb6-91b6b275a9e1 advisory.

    The GStreamer project reports:
    Multiple security issues were identified and fixed in the GStreamer framework.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability was found in the GStreamer RealMedia demuxer (gst-plugins-ugly). When processing a     RealMedia (.rm) file, the demuxer parses MDPR (media properties) chunks to configure audio streams. For     audio stream header versions 4 and 5, the parser reads fields such as codec type, packet size, sample     rate, channel count, and extra codec data length from fixed offsets within the chunk without first     checking that the chunk contains enough data. If a malicious file provides an MDPR chunk that is too small     to contain a complete audio stream header, the parser reads beyond the end of the buffer. This can cause     the application to crash. In some cases, bytes read past the buffer boundary may be incorporated into     stream metadata, which could result in limited information disclosure. (CVE-2026-53703)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365374	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : GStreamer Ugly Plugins vulnerabilities (USN-8896-1)	Nessus	Ubuntu Local Security Checks	Local	high
362166	Rocky Linux 9.6 [TuxCare] Security Update: gstreamer1-plugins-ugly-free Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1784107571)	Nessus	Rocky Linux Local Security Checks	Local	high
361584	AlmaLinux 9.6 [TuxCare] Security Update: gstreamer1-plugins-ugly-free Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1784107571)	Nessus	Alma Linux Local Security Checks	Local	high
357573	Rocky Linux 9 [CIQ] Security Update: gstreamer1-plugins-ugly-free / etc Multiple Vulnerabilities (crlsa-2026_36674)	Nessus	Rocky Linux Local Security Checks	Local	high
357365	Rocky Linux 10.2 [CIQ] Security Update: gstreamer1-plugins-ugly-free / etc (crlsa-2026_36673)	Nessus	Rocky Linux Local Security Checks	Local	high
333274	MiracleLinux 9 : gstreamer1-plugins-ugly-free-1.22.12-6.el9_8.1 (AXSA:2026-1481:01)	Nessus	Miracle Linux Local Security Checks	Local	high
332739	RHEL 10 : gstreamer1-plugins-ugly-free (RHSA-2026:50688)	Nessus	Red Hat Local Security Checks	Local	high
332229	RHEL 9 : gstreamer1-plugins-ugly-free (RHSA-2026:50691)	Nessus	Red Hat Local Security Checks	Local	high
328781	AlmaLinux 10 : gstreamer1-plugins-ugly-free (ALSA-2026:36673)	Nessus	Alma Linux Local Security Checks	Local	high
328743	Oracle Linux 10 : gstreamer1-plugins-ugly-free (ELSA-2026-36673)	Nessus	Oracle Linux Local Security Checks	Local	high
326262	RockyLinux 9 : gstreamer1-plugins-ugly-free (RLSA-2026:36674)	Nessus	Rocky Linux Local Security Checks	Local	high
326256	RockyLinux 10 : gstreamer1-plugins-ugly-free (RLSA-2026:36673)	Nessus	Rocky Linux Local Security Checks	Local	high
326245	GStreamer < 1.28.4 Multiple Vulnerabilities	Nessus	Misc.	Local	high
326057	AlmaLinux 9 : gstreamer1-plugins-ugly-free (ALSA-2026:36674)	Nessus	Alma Linux Local Security Checks	Local	high
325813	Oracle Linux 9 : gstreamer1-plugins-ugly-free (ELSA-2026-36674)	Nessus	Oracle Linux Local Security Checks	Local	high
325743	RHEL 9 : gstreamer1-plugins-ugly-free (RHSA-2026:36674)	Nessus	Red Hat Local Security Checks	Local	high
325666	RHEL 10 : gstreamer1-plugins-ugly-free (RHSA-2026:36673)	Nessus	Red Hat Local Security Checks	Local	high
323684	FreeBSD : gstreamer1 -- multiple vulnerabilities (4e82a0e6-6801-42c6-8fb6-91b6b275a9e1)	Nessus	FreeBSD Local Security Checks	Local	high
321134	Linux Distros Unpatched Vulnerability : CVE-2026-53703	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-53703

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high