CVE-2026-52719: Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds read via jpeg segment length validation in va decoder
An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser reads a segment length value from the bitstream without validating it against available data. A remote attacker could trick a user into opening a specially crafted JPEG file, causing downstream parsing to read beyond the provided input buffer, leading to a crash or potential information disclosure.
Other sources
GStreamer VA JPEG decoder out-of-bounds read vulnerability. In gstjpegparser.c (gst-plugins-bad), the gstjpegparse() function reads a segment length from the bitstream without validating it against available data. The VA JPEG decoder path trusts this untrusted seg->size value and constructs a byte reader over an inflated range, reading past the buffer. The code's own comment explicitly acknowledges this: "a valid segment may be returned with a length that exceeds the available data." Upstream confirmed by maintainer Sebastian Dröge (2026-06-02), who noted it is "actually a bug in the VA JPEG decoder in gst-plugins-bad" and "an OOB read that could lead to a crash or possibly information disclosure." Fix planned for GStreamer 1.28.4 or 1.28.5. Upstream issue: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/workitems/5104 (confidential). Reported via PSIRTSUPT-17026 by JUNYI LIU / Moss 1.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GStreamer gst-plugins-bad (VA JPEG decoder)to a version that resolves this vulnerability.Fixed in 1.28.4 - Upgrade
Upgrade
GStreamer gst-plugins-bad (VA JPEG decoder)to a version that resolves this vulnerability.Fixed in 1.28.5 - Compensating control
If you cannot upgrade immediately, disable or avoid the VA JPEG decoder path in gst-plugins-bad so the out-of-bounds read in the VA JPEG decoder is not reachable when parsing crafted JPEG files.
Event History
Frequently Asked Questions
What is CVE-2026-52719?
CVE-2026-52719 is an out-of-bounds read vulnerability in the VA JPEG decoder of GStreamer's gst-plugins-bad that can be exploited through specially crafted JPEG files.
What is the severity of CVE-2026-52719?
The severity of CVE-2026-52719 is rated high with a CVSS score of 7.1.
How do I fix CVE-2026-52719?
To fix CVE-2026-52719, update GStreamer gst-plugins-bad to the latest patched version provided by your software vendor.
What types of attacks can exploit CVE-2026-52719?
CVE-2026-52719 can be exploited by tricking users into opening specially crafted JPEG files that trigger the vulnerability.
Which software is affected by CVE-2026-52719?
CVE-2026-52719 affects the GStreamer gst-plugins-bad library specifically related to its VA JPEG decoder.