REDHAT-BUG-2497344: Buffer Overflow
A stack buffer overflow was found in GStreamer's DTLS plugin (gst-plugins-bad). In opensslverifycallback(), the peer certificate Subject DN is printed using X509NAMEprintex() into a memory BIO, then read via BIOread() into a fixed gchar buf[2048] on the stack. The number of bytes read comes directly from the X509NAMEprintex() return value without bounds checking against the buffer size.
A remote DTLS peer can send a certificate with an oversized Subject DN (many long OU fields) so that the formatted output exceeds 2048 bytes, causing a stack buffer overflow during the DTLS handshake.
File: subprojects/gst-plugins-bad/ext/dtls/gstdtlsconnection.c Function: opensslverifycallback() (lines 1136-1144)
Exploitability analysis: - The overflow content is TEXT ONLY (X509NAMEprintex with XNFLAGMULTILINE escapes all binary/control characters to printable ASCII sequences like \XX) - Stack canary (-fstack-protector-strong) terminates the process before return address corruption is exploitable - Arbitrary byte injection is impossible: null bytes become \00 (3 printable chars), high-bit bytes become \XX - RCE is NOT achievable. Maximum impact is denial of service (crash)
Attack vector: Unauthenticated remote DTLS-SRTP/WebRTC peer triggers this during handshake by presenting a crafted certificate. No user interaction required.
Affected: GStreamer gst-plugins-bad (reproduced on 1.28.3) Fixed: Planned for GStreamer 1.28.5 Fix MR: https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/mergerequests/99 Upstream issue: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/workitems/5172 (confidential) Advisory: GST-SA-2026-0062
Reporter: Clouditera Security; Z.ai Security; NSFOCUS PSIRT Ticket: PSIRTSUPT-19090
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GStreamer gst-plugins-bad (gst-plugins-bad)to a version that resolves this vulnerability.Fixed in 1.28.5Patch GST-SA-2026-0062 - Compensating control
Mitigate CVE-triggered DTLS handshake denial-of-service by restricting unauthenticated remote DTLS-SRTP/WebRTC peers allowed to initiate handshakes (e.g., block/allow only trusted DTLS-SRTP/WebRTC sources at the network/edge).
- Operational
After upgrading, monitor for and remediate any service crashes caused by crafted oversized certificate Subject DNs during DTLS handshake (DTLS plugin openssl_verify_callback stack buffer overflow) until the fixed version is deployed.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2497344?
The severity of REDHAT-BUG-2497344 is classified as high (7).
What are the potential impacts of REDHAT-BUG-2497344?
The potential impacts of REDHAT-BUG-2497344 include a stack buffer overflow, which may lead to arbitrary code execution or crash of the application.
How do I fix REDHAT-BUG-2497344?
You can fix REDHAT-BUG-2497344 by updating to the latest version of the GStreamer gst-plugins-bad package that addresses this vulnerability.
Which software is affected by REDHAT-BUG-2497344?
The affected software for REDHAT-BUG-2497344 is GStreamer gst-plugins-bad.
When was REDHAT-BUG-2497344 published?
REDHAT-BUG-2497344 was published on July 6, 2026.