CVE-2026-53704: Gstreamer1-plugins-ugly-free: gstreamer: out-of-bounds read in realmedia demuxer fileinfo metadata parser

Synopsis

An out-of-bounds read vulnerability exists in the RealMedia demuxer component of GStreamer's gst-plugins-ugly package. The flaw is reachable over the network and requires no authentication, but a user must open a crafted RealMedia file, making this a user-interaction-dependent attack. Successful exploitation crashes the application, potentially hangs it indefinitely due to an unvalidated loop counter, or leaks a limited amount of adjacent memory contents. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The crafted RealMedia file can be delivered over the network, for example via a download or streaming link, so the attacker must be able to reach the victim's application across the network.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs to deliver the malicious file to an unauthenticated user.

• Victim interactionRequired

  A user must actively open or play the specially crafted RealMedia file, requiring some form of social engineering to trigger the vulnerable code path.

• Attack complexityDetail

  The exploit is reliable and condition-free once the victim opens the file; no race condition, memory-layout dependency, or special environment configuration is required.

Blast Radius

• Crashes the application processing the RealMedia file, causing a denial of service for the affected user session.
• Hangs the application indefinitely when the unvalidated element count triggers an infinite parsing loop, requiring a manual process kill or restart.
• Reads a limited amount of adjacent memory contents beyond the mapped buffer boundary, which may expose nearby in-process data such as string literals or metadata fragments.