GStreamer

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : $100 - $5,000 Google Patch Rewards pays this project as a Tier 2 target (it qualifies through its OSS-Fuzz integration), for a patch you land upstream and that stays merged, without reverts, for one month. It is paid for the patch, not for the report, and it is rate-limited to three submissions a month. Sanctions and territory exclusions apply. CVE history 19 Last 12 months 103 Lifetime Memory safety 70 % Code execution 18 % Denial of service 9 % Latest advisories Loading the feed Overview GStreamer runs a coordinated vulnerability disclosure program but funds no bounty of its own. Report qualifying findings through sorona.xyz and we pay you directly on reproduced, in-scope reports, up to 2x the base reward for hard, chained bugs. GStreamer is the pipeline-based multimedia framework behind media playback across Linux and beyond, spanning demuxers, decoders, parsers, and a vast plugin ecosystem. Because its core job is parsing untrusted, attacker-controlled media, its security posture is dominated by memory-safety issues in C, so buffer overflows, out-of-bounds reads and writes, integer overflows, and NULL dereferences make up the bulk of its historical CVEs. In scope Container demuxers and parsers that ingest untrusted media: Matroska/WebM (matroskademux), MP4/MOV/ISOBMFF (qtdemux), ASF/WMV (asfdemux), RealMedia, MXF, Ogg (oggdemux), AVI (avidemux), and FLV (flvdemux). Video decoders and parsers, including H.264/AVC, H.265/HEVC, H.266/VVC, AV1, VP8/VP9, MPEG, JPEG, and VMnc. Audio decoders and parsers such as Opus, Vorbis, FLAC, WavPack, SBC, CELT, and QDM2, plus the PCM and format-converter paths. Subtitle and caption parsers: SubRip (SRT), SSA/ASS, DVB subtitles, MicroDVD, TMPlayer, and LRC. Metadata and tag parsers, including ID3v2, EXIF, XMP, FLAC tags, and Vorbis comments. RTP/RTSP and streaming surfaces: rtspsrc, RTP depayloaders parsing network payloads, WebRTC, SDP/RTCP handling, and HLS/DASH adaptive-streaming manifest and fragment parsing. Core buffer, caps, and typefind logic together with the gst-plugins-base, -good, -bad, and -ugly plugin sets and the gst-libav FFmpeg wrapper. Any element that consumes attacker-controllable byte streams from files, the network, or capture devices. Out of scope Flaws living in third-party codec libraries that GStreamer merely wraps (for example FFmpeg/libav or libvpx internals) unless the defect is in GStreamer's own binding or usage. Denial-of-service that depends on unrealistic resource exhaustion, or crashes reachable only with debug builds, sanitizers, or assertions enabled. Issues that require the application to load attacker-supplied plugins or accept a malicious pipeline string the user already fully controls. Findings in unmaintained forks, distro-specific patches, or release series past end of support. Local misconfiguration or insecure file permissions introduced by packaging rather than upstream code. Theoretical reports with no reproducible crash or memory-safety trigger, and bare hardening suggestions. Most-valued findings Memory-safety bugs in media parsing: heap and stack buffer overflow, out-of-bounds read, and out-of-bounds write (CWE-122/121/125/787) reachable from untrusted input. Integer overflow or underflow (CWE-190/191) that yields undersized allocations or bad indexing during demux or decode. Use-after-free and double-free (CWE-416/415) in event and flow handling, caps negotiation, buffer pools, or element teardown. NULL-pointer dereference and heap corruption (CWE-476) driven by malformed streams, including gst-rtsp-server request handling. Type confusion in element and pad handling. Remote code execution reachable simply by opening or streaming a crafted media file. Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Submit through sorona.xyz with a minimal reproducing sample file or stream plus the affected element, plugin set, and version or git commit Report privately first; do not open public merge requests or issues that reveal the flaw before a fix ships Include an ASAN or Valgrind trace where possible, or a clear stack trace showing the faulting element and code path Test against a current stable or development build so the finding maps to code that is still maintained Do not test against production media services, third-party deployments, or infrastructure you do not own One distinct root cause per report; note if a single parsing bug is reachable through multiple containers or plugins Disclosure Report privately and coordinate with GStreamer maintainers, who fix issues before publishing a numbered security advisory (GStreamer-SA-YYYY-NNNN) with the associated CVE. Give maintainers reasonable time to release a bug-fix version before any public disclosure. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability