CVE-2026-53703: Gstreamer1-plugins-ugly-free: gstreamer: out-of-bounds read in realmedia demuxer audio stream header parser

Synopsis

An out-of-bounds read vulnerability exists in the GStreamer RealMedia demuxer (gst-plugins-ugly), specifically in the audio stream header parser for MDPR chunks. The flaw is reachable over the network without any authentication, but requires a user to open a maliciously crafted .rm file. Successful exploitation crashes the affected application and, in some cases, exposes bytes from memory adjacent to the parsed buffer. No fix version has been published yet; HarborGuard tracks the upstream advisory and will make a patched-image rebuild available as soon as a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must deliver the malicious .rm file over the network to a target that will open it, making over-the-network exposure a prerequisite.

• AuthenticationNot required

  No authentication or account credentials are needed to exploit this vulnerability; any unauthenticated party can supply a crafted file.

• Victim interactionRequired

  A user or automated process must open the maliciously crafted RealMedia file, making this a social-engineering or file-delivery attack rather than a direct network exploit.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental tuning to trigger.

Blast Radius

• Crashes the application processing the malicious .rm file, disrupting any service or pipeline that depends on GStreamer-based media handling.
• In some cases, bytes read past the buffer boundary are incorporated into stream metadata, leaking a limited amount of adjacent process memory content to the attacker.