A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a RealMedia file containing a specially crafted FILEINFO metadata section, the demuxer parses variable-name and variable-value pairs using re_skip_pascal_string() without validating that offsets remain within the mapped buffer. Additionally, the element count controlling the parsing loop is read from attacker-controlled data without validation, which can cause an infinite loop. A crafted RealMedia file can cause the application to crash, hang, or potentially read limited adjacent memory contents.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:36674 advisory.

    * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header     parser (CVE-2026-53703)

    * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer FILEINFO metadata     parser (CVE-2026-53704)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of GStreamer installed on the remote host is prior to 1.28.4. It is, therefore, affected by multiple vulnerabilities:

  - Multiple vulnerabilities were found in the RealMedia demuxer (rmdemux) and RealAudio demuxer (rademux)     elements in gst-plugins-ugly. The demuxers lacked proper bounds validation when parsing file headers,     stream properties, and audio packets, allowing out-of-bounds reads beyond the boundaries of the provided     data buffers. Additionally, the use of signed integer types for size and length parameters could lead to     integer overflows during size calculations and index operations. A malicious third party could trigger     out-of-bounds reads or integer overflows by providing a crafted RealMedia file, potentially resulting in     a crash, denial of service, or information disclosure. (CVE-2026-53703, CVE-2026-53704)

  - A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially     crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels)     in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes     decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects     both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to     the allocation size type. A remote attacker could use this flaw to crash an application or potentially     execute arbitrary code by convincing a user to open a malicious WavPack audio file. (CVE-2026-53705)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:36674 advisory.

    * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header     parser (CVE-2026-53703)
      * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer FILEINFO metadata     parser (CVE-2026-53704)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-36674 advisory.

    - Fix CVE-2026-53704: multiple rmdemux security issues

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:36674 advisory.

    GStreamer is a streaming media framework, based on graphs of elements which operate on media data.  This     package contains plug-ins whose license is not fully compatible with LGPL.

    Security Fix(es):

    * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header     parser (CVE-2026-53703)

    * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer FILEINFO metadata     parser (CVE-2026-53704)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 4e82a0e6-6801-42c6-8fb6-91b6b275a9e1 advisory.

    The GStreamer project reports:
    Multiple security issues were identified and fixed in the GStreamer framework.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a     RealMedia file containing a specially crafted FILEINFO metadata section, the demuxer parses variable-name     and variable-value pairs using re_skip_pascal_string() without validating that offsets remain within the     mapped buffer. Additionally, the element count controlling the parsing loop is read from attacker-     controlled data without validation, which can cause an infinite loop. A crafted RealMedia file can cause     the application to crash, hang, or potentially read limited adjacent memory contents. (CVE-2026-53704)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
326262	RockyLinux 9 : gstreamer1-plugins-ugly-free (RLSA-2026:36674)	Nessus	Rocky Linux Local Security Checks	high
326245	GStreamer < 1.28.4 Multiple Vulnerabilities	Nessus	Misc.	high
326057	AlmaLinux 9 : gstreamer1-plugins-ugly-free (ALSA-2026:36674)	Nessus	Alma Linux Local Security Checks	high
325813	Oracle Linux 9 : gstreamer1-plugins-ugly-free (ELSA-2026-36674)	Nessus	Oracle Linux Local Security Checks	high
325743	RHEL 9 : gstreamer1-plugins-ugly-free (RHSA-2026:36674)	Nessus	Red Hat Local Security Checks	high
323684	FreeBSD : gstreamer1 -- multiple vulnerabilities (4e82a0e6-6801-42c6-8fb6-91b6b275a9e1)	Nessus	FreeBSD Local Security Checks	high
321148	Linux Distros Unpatched Vulnerability : CVE-2026-53704	Nessus	Misc.	high

Detections

Analytics

CVE-2026-53704

high

Tenable Plugins

high

high

high

high

high

high

high