CVE-2026-52718: Gstreamer1-plugins-bad-free: gstreamer: denial of service via av1 tile_list_obu parser byte/bit confusion
A denial of service vulnerability was found in GStreamer's AV1 codec parser in gst-plugins-bad. The gstav1parserparsetilelistobu() function passes a byte count to a bit-reader API that expects a bit count, causing parser desynchronization. A remote attacker could trick a user into opening a specially crafted AV1 media file, triggering an assertion abort and causing the application to crash.
Other sources
GStreamer AV1 tilelistobu parser abort vulnerability. The gstav1parserparsetilelistobu() function in gstav1parser.c (gst-plugins-bad) passes a byte count to gstbitreaderskip(), which expects a bit count. This causes parser desynchronization and a deterministic gassert abort when processing a specially crafted AV1 media file. A 21-byte test case is sufficient to trigger the crash. Upstream confirmed by maintainer Sebastian Dröge (2026-06-02). Fix planned for GStreamer 1.28.4 or 1.28.5. Upstream issue: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/workitems/5103 (confidential). Reported via PSIRTSUPT-17026 by JUNYI LIU / Moss 1.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/gst-plugins-bad1.0to a version that resolves this vulnerability.Fixed in 1.22.0-4+deb12u8 - Upgrade
Upgrade
debian/gst-plugins-bad1.0to a version that resolves this vulnerability.Fixed in 1.26.2-3+deb13u2 - Upgrade
Upgrade
debian/gst-plugins-bad1.0to a version that resolves this vulnerability.Fixed in 1.28.4-1 - Upgrade
Upgrade
debian/gst-plugins-bad1.0to a version that resolves this vulnerability.Fixed in 1.22.0-4+deb12u8Fixed in 1.26.2-3+deb13u3Fixed in 1.28.8-1Fixed in 1.28.9-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52718?
The severity of CVE-2026-52718 is classified as medium with a score of 6.5.
How do I fix CVE-2026-52718?
To fix CVE-2026-52718, update GStreamer and gst-plugins-bad to the latest version that includes the patched parser.
What is the nature of the vulnerability in CVE-2026-52718?
CVE-2026-52718 is a denial of service vulnerability in the AV1 codec parser due to a byte/bit count confusion.
Can CVE-2026-52718 be exploited remotely?
Yes, CVE-2026-52718 can be exploited remotely if a user is tricked into opening a specially crafted media file.
What software is affected by CVE-2026-52718?
CVE-2026-52718 affects the GStreamer framework specifically the gst-plugins-bad module.