CVE-2026-5056

HighCVSS 7.8/10Last modified Jul 30, 2026

Description

GStreamer qtdemux Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the parsing of UncompressedFrameConfigBox structures. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29392.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Jul 29, 2026
Last modified
Jul 30, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-505605.3Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, CVE-2026-505619.4Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project'sCVE-2026-505629.3FastGPT is a knowledge-based AI application platform. At commit 22ebfacbb43311e9b73294040ae0eb87390c6bba and earlier, artifacts built from uCVE-2026-505639.9Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on KubernetesCVE-2026-505649.9Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on KubernetesCVE-2026-505654.9Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on KubernetesCVE-2026-505669.9Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on KubernetesCVE-2026-505677.7Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on KubernetesCVE-2026-505683.6Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on KubernetesCVE-2026-505694.3Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on KubernetesCVE-2026-50577.5ATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a deniaCVE-2026-505708.5Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes
CVE-2026-5056: High severity, CVSS 7.8 | Vulnix