CVE-2026-59692: Gstreamer: gstreamer: dtls certificate subject dn stack buffer overflow in openssl_verify_callback
A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed into a fixed-size 2048-byte stack buffer without bounds checking. A remote unauthenticated attacker can send a certificate with an oversized Subject DN that exceeds the buffer, causing a stack buffer overflow and process crash, resulting in denial of service.
Other sources
A stack buffer overflow was found in GStreamer's DTLS plugin (gst-plugins-bad). In opensslverifycallback(), the peer certificate Subject DN is printed using X509NAMEprintex() into a memory BIO, then read via BIOread() into a fixed gchar buf[2048] on the stack. The number of bytes read comes directly from the X509NAMEprintex() return value without bounds checking against the buffer size.
A remote DTLS peer can send a certificate with an oversized Subject DN (many long OU fields) so that the formatted output exceeds 2048 bytes, causing a stack buffer overflow during the DTLS handshake.
File: subprojects/gst-plugins-bad/ext/dtls/gstdtlsconnection.c Function: opensslverifycallback() (lines 1136-1144)
Exploitability analysis: - The overflow content is TEXT ONLY (X509NAMEprintex with XNFLAGMULTILINE escapes all binary/control characters to printable ASCII sequences like \XX) - Stack canary (-fstack-protector-strong) terminates the process before return address corruption is exploitable - Arbitrary byte injection is impossible: null bytes become \00 (3 printable chars), high-bit bytes become \XX - RCE is NOT achievable. Maximum impact is denial of service (crash)
Attack vector: Unauthenticated remote DTLS-SRTP/WebRTC peer triggers this during handshake by presenting a crafted certificate. No user interaction required.
Affected: GStreamer gst-plugins-bad (reproduced on 1.28.3) Fixed: Planned for GStreamer 1.28.5 Fix MR: https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/mergerequests/99 Upstream issue: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/workitems/5172 (confidential) Advisory: GST-SA-2026-0062
Reporter: Clouditera Security; Z.ai Security; NSFOCUS PSIRT Ticket: PSIRTSUPT-19090
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GStreamer gst-plugins-badto a version that resolves this vulnerability.Fixed in 1.28.5Patch GST-SA-2026-0062 - Compensating control
Mitigate denial-of-service risk by restricting/limiting unauthenticated DTLS-SRTP/WebRTC peer access to the affected service/endpoint (e.g., via network ACLs or firewall rules) until GStreamer gst-plugins-bad is updated to 1.28.5.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59692?
The severity of CVE-2026-59692 is rated high with a score of 7.5.
What is CVE-2026-59692?
CVE-2026-59692 is a stack buffer overflow vulnerability in GStreamer's DTLS plugin that occurs during a DTLS handshake.
How does CVE-2026-59692 affect GStreamer users?
CVE-2026-59692 allows a remote unauthenticated attacker to exploit the vulnerability by sending a certificate with oversized data.
How do I fix CVE-2026-59692?
To fix CVE-2026-59692, update the GStreamer gst-plugins-bad package to the latest version that addresses this vulnerability.
What software is impacted by CVE-2026-59692?
CVE-2026-59692 affects the GStreamer gst-plugins-bad software package.