CVE-2026-3085

🗓️ 16 Mar 2026 14:29:42Reported by redhat.comType

Heap-based buffer overflow in GStreamer rtpqdm2depay enables remote code execution via unvalidated X-QDM RTP payloads.

Reporter	Title	Published	Views	Family All 149
FreeBSD	gstreamer1 -- multiple vulnerabilities	25 Feb 202600:00	–	freebsd
ATTACKERKB	CVE-2026-3085	13 Mar 202620:40	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : gstreamer1-plugins-good, gstreamer1-plugins-good-gtk (ALAS2023-2026-1503)	1 Apr 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : gstreamer1-plugins-good, --advisory ALAS2-2026-3209 (ALAS-2026-3209)	1 Apr 202600:00	–	nessus
Tenable Nessus	AlmaLinux 10 : gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free (ALSA-2026:6259)	5 Apr 202600:00	–	nessus
Tenable Nessus	AlmaLinux 9 : gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free (ALSA-2026:6300)	5 Apr 202600:00	–	nessus
Tenable Nessus	AlmaLinux 8 : gstreamer1-plugins-bad-free, gstreamer1-plugins-base, and gstreamer1-plugins-good (ALSA-2026:6750)	10 Apr 202600:00	–	nessus
Tenable Nessus	Fedora 42 : mingw-gstreamer1 / mingw-gstreamer1-plugins-bad-free / etc (2026-3cc99e7d09)	5 Apr 202600:00	–	nessus
Tenable Nessus	Fedora 43 : mingw-gstreamer1 / mingw-gstreamer1-plugins-bad-free / etc (2026-e6d8e9fd49)	5 Apr 202600:00	–	nessus
Tenable Nessus	FreeBSD : gstreamer1 -- multiple vulnerabilities (791d4b29-19fb-11f1-87cc-e73692421fef)	7 Mar 202600:00	–	nessus

Source	Link
cve	www.cve.org/CVERecord
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-3085
gitlab	www.gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/d60a94dee3c0a0942c9981491bf83e0de1900fbf
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-26-167/
bugzilla	www.bugzilla.redhat.com/show_bug.cgi

16 Mar 2026 14:29Current

6.7Medium risk

Vulners AI Score6.7

CVSS 38.8

CVSS 3.18.8

EPSS0.00253

SSVC