CVE-2026-5056

GStreamer qtdemux Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of UncompressedFrameConfigBox structures. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29392.

• CWE-121

• https://gitlab.freedesktop.org/api/v4/projects/gstreamer%2Fgstreamer/repository/files/security-advisories%2Fsa-2026-0016.md/raw?ref=main
• https://www.zerodayinitiative.com/advisories/ZDI-26-283/
• http://www.openwall.com/lists/oss-security/2026/05/01/1

Published

Jul 29, 2026

Last Modified

Jul 30, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50552Koel is a free, open-source music streaming solution. Prior …6.3
• CVE-2026-50555Angular is a development platform for building mobile and de…6.1
• CVE-2026-50556Angular is a development platform for building mobile and de…6.1
• CVE-2026-50557Angular is a development platform for building mobile and de…6.1
• CVE-2026-50558Penelope Shell Handler is a post-exploitation shell handler …5.9
• CVE-2026-50559Quarkus is a Java framework for building cloud-native applic…7.5
• CVE-2026-50560Netty is a network application framework for development of …5.3
• CVE-2026-50561Yuxi is a large-model-based intelligent knowledge base and k…9.4
• CVE-2026-50562FastGPT is a knowledge-based AI application platform. At com…9.3
• CVE-2026-50563Fission is an open-source, Kubernetes-native serverless fram…9.9
• CVE-2026-50564Fission is an open-source, Kubernetes-native serverless fram…9.9
• CVE-2026-50565Fission is an open-source, Kubernetes-native serverless fram…4.9