CVE-2026-125040: Gst-plugins-base: gst-plugins-base: quadratic regex processing in srt/webvtt subtitle parser causes denial of service

Q: Which applications are exposed to this issue?

GStreamer-based applications that use the gst-plugins-base SRT or WebVTT subtitle parser (subparse) are exposed when they process crafted subtitle files or cues.

Q: What does an attacker need to exploit it?

An attacker needs to cause the application to parse a crafted SRT or WebVTT subtitle cue containing a long line of unmatched markup-like text. No privileges are required, but user interaction is required.

Q: What is the impact of successful exploitation?

The crafted subtitle content can trigger quadratic CPU consumption while inline markup is sanitized, causing the affected GStreamer-based application to become unresponsive. The provided impact is limited to availability.

Q: What version contains the fix?

The issue is fixed in gst-plugins-base 1.28.2.

Published Nov 9, 2026

Updated

A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle markup, the parser repeatedly searches the remaining text with unanchored regular expressions. A crafted subtitle cue with a long line of unmatched markup-like text can force quadratic CPU use and make a GStreamer-based application unresponsive.

Other sources

GStreamer-SA-2026-0023: The SRT/WebVTT subtitle parser (subparse) uses regular-expression matching and replacement with quadratic time complexity for long lines. A crafted subtitle file can cause excessive CPU use and application unresponsiveness. Fixed in gst-plugins-base 1.28.2.

— Red Hat

Affected Software

1 affected component

GStreamer gst-plugins-base<1.28.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade gst-plugins-base to a version that resolves this vulnerability.
Fixed in 1.28.2

Event History

Nov 9, 2026

Data Sourced

via Red Hat·12:55 PM

DescriptionSeverityAffected Software

CVE Published

via MITRE·06:16 PM

Data Sourced

via MITRE·06:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which applications are exposed to this issue?

GStreamer-based applications that use the gst-plugins-base SRT or WebVTT subtitle parser (subparse) are exposed when they process crafted subtitle files or cues.

What does an attacker need to exploit it?

An attacker needs to cause the application to parse a crafted SRT or WebVTT subtitle cue containing a long line of unmatched markup-like text. No privileges are required, but user interaction is required.

What is the impact of successful exploitation?

The crafted subtitle content can trigger quadratic CPU consumption while inline markup is sanitized, causing the affected GStreamer-based application to become unresponsive. The provided impact is limited to availability.

What version contains the fix?

The issue is fixed in gst-plugins-base 1.28.2.

CVE-2026-125040: Gst-plugins-base: gst-plugins-base: quadratic regex processing in srt/webvtt subtitle parser causes denial of service

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

What version contains the fix?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

What version contains the fix?