CVE-2026-119843: Gst-plugins-good: assertion failures in FLV demuxer when parsing malformed enhanced audio/video tags

Q: Which deployments are exposed to this issue?

Applications using the GStreamer gst-plugins-good FLV demuxer are exposed when they open or stream attacker-controlled FLV content containing enhanced RTMP v2 audio or video tags. The affected software listed includes Ubuntu and Debian gst-plugins-good1.0 packages.

Q: What does an attacker need to exploit the flaw?

An attacker needs to provide a specially crafted malformed or truncated FLV file and have it opened or streamed by a GStreamer-based application. No attacker privileges are required, but user interaction is required to process the media.

Q: What is the impact of successful exploitation?

Processing the crafted FLV stream can trigger an assertion failure or crash in the application using the demuxer. The documented impact is denial of service; no confidentiality or integrity impact is specified.

Q: What version contains the upstream fix?

The issue is fixed in gst-plugins-good 1.28.2. The affected parsing behavior applies to versions before 1.28.2.

Published Oct 30, 2026

Updated

A flaw was found in GStreamer's gst-plugins-good package. The FLV media demuxer does not properly validate buffer sizes and data availability when processing enhanced audio and video tags in malformed or truncated FLV streams. A remote attacker could exploit this vulnerability by providing a specially crafted FLV media file that, when opened or streamed by a GStreamer-based application, triggers an assertion failure or a process crash, leading to denial of service.

Other sources

gst-plugins-good FLV demuxer (gst/flv/gstflvdemux.c): missing GstByteReader return checks in gstflvdemuxparsetagaudio/video before 1.28.2 when parsing Enhanced RTMP v2 tags; malformed FLV can crash the process (DoS). Fixed in gst-plugins-good 1.28.2 (MR !11244). Upstream GStreamer-SA-2026-0020 (2026-04-07). CVE CVE-2026-119843.

— Red Hat

Affected Software

9 affected componentsFixes available

debian/gst-plugins-good1.0<=1.22.0-5+deb12u3, <=1.22.0-5+deb12u4, <=1.26.2-1+deb13u2

1.28.8-1

debian/gst-plugins-good1.0*

debian/gst-plugins-good1.0<1.28.2-1

1.28.2-1

ubuntu/gst-plugins-good1.0*

Event History

Oct 30, 2026

Data Sourced

via Red Hat·04:54 PM

DescriptionSeverityAffected Software

Nov 3, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

CVE Published

via MITRE·09:45 AM

Data Sourced

via MITRE·09:45 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Applications using the GStreamer gst-plugins-good FLV demuxer are exposed when they open or stream attacker-controlled FLV content containing enhanced RTMP v2 audio or video tags. The affected software listed includes Ubuntu and Debian gst-plugins-good1.0 packages.

What does an attacker need to exploit the flaw?

An attacker needs to provide a specially crafted malformed or truncated FLV file and have it opened or streamed by a GStreamer-based application. No attacker privileges are required, but user interaction is required to process the media.

What is the impact of successful exploitation?

Processing the crafted FLV stream can trigger an assertion failure or crash in the application using the demuxer. The documented impact is denial of service; no confidentiality or integrity impact is specified.

What version contains the upstream fix?

The issue is fixed in gst-plugins-good 1.28.2. The affected parsing behavior applies to versions before 1.28.2.

CVE-2026-119843: Gst-plugins-good: assertion failures in FLV demuxer when parsing malformed enhanced audio/video tags

Other sources

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the flaw?

What is the impact of successful exploitation?

What version contains the upstream fix?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the flaw?

What is the impact of successful exploitation?

What version contains the upstream fix?