Security Advisory 2026-0053 (ZDI-CAN-29584)

Details

A stack-based and heap-based buffer overflow vulnerability in the Opus audio decoder in gst-plugins-base when processing Opus streams with more than 64 channels. The decoder uses the channel count from the stream header to determine the size of memory operations on fixed-size 64-element arrays, causing out-of-bounds writes when the channel count exceeds this limit.

Impact

A malicious third party could trigger a stack and heap buffer overflow by providing a crafted Opus stream with an excessive channel count. This could result in application crash, denial of service, data corruption, or possibly arbitrary code execution through stack manipulation or pointer corruption.

Solution

The gst-plugins-base 1.28.5 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.5 release

• Release Notes
• GStreamer Plugins Base 1.28.5

Patches

• Patch