CVE-2026-53703 Details

An out-of-bounds read vulnerability has been identified in the GStreamer RealMedia demuxer, part of the gst-plugins-ugly package. This issue arises when the demuxer processes RealMedia (.rm) files and parses MDPR (media properties) chunks to configure audio streams. For audio stream header versions 4 and 5, the parser reads critical fields, including codec type, packet size, sample rate, channel count, and extra codec data length, from fixed offsets within the MDPR chunk. However, the parser fails to verify whether the chunk contains sufficient data before reading these fields. As a result, if a malicious .rm file provides an MDPR chunk that is too small, the parser can read beyond the end of the buffer, leading to a crash. In some instances, the bytes read past the buffer boundary may be leaked into stream metadata, potentially causing limited information disclosure.