CVE-2026-53704: Gstreamer1-plugins-ugly-free: gstreamer: out-of-bounds read in realmedia demuxer fileinfo metadata parser
A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a RealMedia file containing a specially crafted FILEINFO metadata section, the demuxer parses variable-name and variable-value pairs using reskippascalstring() without validating that offsets remain within the mapped buffer. Additionally, the element count controlling the parsing loop is read from attacker-controlled data without validation, which can cause an infinite loop. A crafted RealMedia file can cause the application to crash, hang, or potentially read limited adjacent memory contents.
Other sources
GStreamer RealMedia demuxer FILEINFO metadata OOB read. In gstrmdemuxparsemdpr(), the FILEINFO parsing loop (while elementnb) advances offset using reskippascalstring() without bounds checking. reskippascalstring() reads a length byte at the current offset and returns offset + 1 + length without validating the buffer boundary. elementnb is attacker-controlled and stored as signed int; value 0xFFFFFFFF causes infinite loop. No fix available; upstream recommends rmdemux rewrite. Reported via PSIRTSUPT-7239 by Tianshuo Han.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Do not process untrusted RealMedia (RealMedia demuxer / FILEINFO metadata) files with the GStreamer gst-plugins-ugly free package; restrict upload/download sources and block RealMedia inputs from untrusted senders to prevent the gst-plugins-ugly RealMedia demuxer from parsing attacker-controlled FILEINFO data.
- Compensating control
Apply upstream mitigation guidance to avoid triggering gst_rmdemux_parse_mdpr() FILEINFO parsing without bounds checking; prioritize replacing the GStreamer RealMedia demuxer with a rewritten/safer implementation (upstream recommends rmdemux rewrite) since no fix is available for gst-plugins-ugly-free.
- Compensating control
If RealMedia must be handled, add a pre-parse guard outside GStreamer to reject RealMedia FILEINFO sections where the element count would be invalid (e.g., values that could lead to an infinite loop such as 0xFFFFFFFF) and where Pascal-string fields would exceed the mapped buffer length.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53704?
CVE-2026-53704 has a severity rating of 7.1, categorized as high.
How do I fix CVE-2026-53704?
To fix CVE-2026-53704, ensure that you update to the latest version of GStreamer gst-plugins-ugly that addresses the vulnerability.
What type of vulnerability is CVE-2026-53704?
CVE-2026-53704 is an out-of-bounds read vulnerability in the RealMedia demuxer of GStreamer.
What impact does CVE-2026-53704 have?
CVE-2026-53704 can lead to a denial of service due to the out-of-bounds read in the metadata parser.
What software is affected by CVE-2026-53704?
CVE-2026-53704 affects the GStreamer gst-plugins-ugly package.