CVE-2026-125706: Gst-plugins-bad: gst-plugins-bad: missing bounds checks in mpeg ps pes header parsing
A flaw was found in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin. The PES header parsers do not adequately check remaining data before reading timestamps and optional header fields. Opening a specially crafted MPEG Program Stream file can cause an out-of-bounds read and potentially crash the application, resulting in a denial of service.
Other sources
GStreamer-SA-2026-0024: Malformed MPEG Program Stream files can trigger out-of-bounds reads in the mpegdemux element and resindvd PES filter. The issues include missing bounds checks for DTS/PTS timestamps and PES extension fields, insufficient validation while scanning timestamps, and possible integer overflows in length calculations. Impact may include crashes, denial of service, and information disclosure. Fixed in gst-plugins-bad 1.28.3.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gst-plugins-badto a version that resolves this vulnerability.Fixed in 1.28.3
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications that use the gst-plugins-bad MPEG Program Stream demuxer or the resindvd DVD-playback plugin are exposed when they open a specially crafted MPEG Program Stream file.
What does an attacker need to exploit it?
An attacker needs to persuade a user or application to open a specially crafted MPEG Program Stream file. The provided vector indicates local attack access, no privileges required, and user interaction required.
What is the likely impact of successful exploitation?
Successful exploitation can trigger an out-of-bounds read and crash the affected application, causing a denial of service. No confidentiality or integrity impact is indicated by the provided severity vector.