CVE-2026-53703

Publication date 15 June 2026

Last updated 8 October 2026

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

7.1 · High

Score breakdown

Description

A vulnerability was found in the GStreamer RealMedia demuxer (gst-plugins-ugly). When processing a RealMedia (.rm) file, the demuxer parses MDPR (media properties) chunks to configure audio streams. For audio stream header versions 4 and 5, the parser reads fields such as codec type, packet size, sample rate, channel count, and extra codec data length from fixed offsets within the chunk without first checking that the chunk contains enough data. If a malicious file provides an MDPR chunk that is too small to contain a complete audio stream header, the parser reads beyond the end of the buffer. This can cause the application to crash. In some cases, bytes read past the buffer boundary may be incorporated into stream metadata, which could result in limited information disclosure.

Status

Package Ubuntu Release Status
gst-plugins-ugly1.0 26.04 LTS resolute
Fixed 1.28.2-1ubuntu0.1~esm1
25.10 questing Ignored end of life, was needs-triage
24.04 LTS noble
Fixed 1.24.1-1ubuntu0.1~esm1
22.04 LTS jammy
Fixed 1.20.1-1ubuntu0.1~esm1
20.04 LTS focal
Fixed 1.16.2-2ubuntu0.1~esm1
18.04 LTS bionic
Fixed 1.14.5-0ubuntu1~18.04.1+esm1
16.04 LTS xenial
Fixed 1.8.3-1ubuntu0.1+esm2

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro 30-day free trial

Severity score breakdown

CVSS version: CVSS v3.0

Base score 7.1 · High

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

References

Related Ubuntu Security Notices (USN)

    • USN-8896-1
    • GStreamer Ugly Plugins vulnerabilities
    • 7 October 2026

Other references

Access our resources on patching vulnerabilities