CVE-2026-3085

Key detail from vendor description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer through a heap-based buffer overflow in the rtpqdm2depay component. The flaw arises from insufficient validation of the length of user-supplied data before copying it into a heap-based buffer while processing X‑QDM RTP payloads. An attacker can exploit this to run code in the context of the current process, thereby compromising confidentiality, integrity, and availability of the host system.

Affected systems include any installation of GStreamer that includes the rtpqdm2depay module; the CNA identifies the product as GStreamer:GStreamer with no specific producer or compilation details. No affected version range is provided in the CNA data, so all builds that include this component are potentially vulnerable until a fix is released.

The CVSS score of 8.8 indicates high severity, and the EPSS score of less than 1% suggests a low current exploit probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, requiring interaction with the RTP de‑multiplexer component; an attacker may supply crafted X‑QDM payloads over a network to trigger the overflow. No known exploit public code is referenced in the provided data, but the ability to execute arbitrary code is direct and conclusive.