Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

GStreamer bug bounty programs

freedesktop.org Updated

GStreamer runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
9
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program GStreamer runs.

  • GStreamer

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

9 targets. 6 excluded.

  • https://gstreamer.freedesktop.org

    Web

  • Any element that consumes attacker-controllable byte streams from files, the network, or capture devices.

    Products and areas

  • Audio decoders and parsers such as Opus, Vorbis, FLAC, WavPack, SBC, CELT, and QDM2, plus the PCM and format-converter paths.

    Products and areas

  • Container demuxers and parsers that ingest untrusted media: Matroska/WebM (matroskademux), MP4/MOV/ISOBMFF (qtdemux), ASF/WMV (asfdemux), RealMedia, MXF, Ogg (oggdemux), AVI (avidemux), and FLV (flvdemux).

    Products and areas

  • Core buffer, caps, and typefind logic together with the gst-plugins-base, -good, -bad, and -ugly plugin sets and the gst-libav FFmpeg wrapper.

    Products and areas

  • Metadata and tag parsers, including ID3v2, EXIF, XMP, FLAC tags, and Vorbis comments.

    Products and areas

  • RTP/RTSP and streaming surfaces: rtspsrc, RTP depayloaders parsing network payloads, WebRTC, SDP/RTCP handling, and HLS/DASH adaptive-streaming manifest and fragment parsing.

    Products and areas

  • Subtitle and caption parsers: SubRip (SRT), SSA/ASS, DVB subtitles, MicroDVD, TMPlayer, and LRC.

    Products and areas

  • Video decoders and parsers, including H.264/AVC, H.265/HEVC, H.266/VVC, AV1, VP8/VP9, MPEG, JPEG, and VMnc.

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Denial-of-service that depends on unrealistic resource exhaustion, or crashes reachable only with debug builds, sanitizers, or assertions enabled.

  • Findings in unmaintained forks, distro-specific patches, or release series past end of support.

  • Flaws living in third-party codec libraries that GStreamer merely wraps (for example FFmpeg/libav or libvpx internals) unless the defect is in GStreamer's own binding or usage.

  • Issues that require the application to load attacker-supplied plugins or accept a malicious pipeline string the user already fully controls.

  • Local misconfiguration or insecure file permissions introduced by packaging rather than upstream code.

  • Theoretical reports with no reproducible crash or memory-safety trigger, and bare hardening suggestions.

Recent changes

Reward and scope changes across every GStreamer program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in GStreamer products, from the NVD.

Search NVD
  • CVE-2026-50292 High

    In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution

  • CVE-2026-46469 Medium

    An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's qtdemux_parse_trak function does not sufficiently validate atom data before performing division operations, leading to denial of service due to integer division by zero.

  • CVE-2026-46470 Medium

    An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's qtdemux_audio_caps function does not sufficiently validate atom data before performing division operations, leading to denial of service due to integer division by zero.

  • CVE-2026-35094 Low

    A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can exploit a dangling pointer vulnerability. This occurs when a garbage collection cleanup function is called, leaving a pointer that can then be printed to system logs. This could potentially expose sensitive data if the memory location is re-used, leading to information disclosure. Fo

  • CVE-2026-35093 High

    A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypass security restrictions. This allows the attacker to run unauthorized code with the same permissions as the program using libinput, such as a graphical compositor. This could lead to the attacker monitoring keyboard input and sending that i

  • CVE-2026-4897 Medium

    A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid binary via standard input (stdin). This unbounded input can lead to an out-of-memory (OOM) condition, resulting in a Denial of Service (DoS) for the system.

  • CVE-2026-1940 Medium

    An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.

  • CVE-2026-26103 High

    A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus API for restoring LUKS encryption headers without proper authorization checks. The issue allows a local unprivileged user to instruct the root-owned udisks daemon to overwrite encryption metadata on block devices. This can permanently invalidate encryption keys and render encrypted volumes inaccessible. Succes

About this page

This page gathers every public program listed under freedesktop.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.