CVE-2026-53704

Name of the Vulnerable Software and Affected Versions GStreamer (affected versions not specified)

Description A flaw exists in the RealMedia demuxer within the gst-plugins-ugly package. When processing a RealMedia file with a specially crafted FILEINFO metadata section, the demuxer uses the re skip pascal string() function to parse variable-name and variable-value pairs without verifying that offsets stay within the mapped buffer. Furthermore, the element count that controls the parsing loop is read from attacker-controlled data without validation, which can lead to an infinite loop. This can result in application crashes, hangs, or the potential reading of limited adjacent memory contents.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.