CVE-2026-52721: Gstreamer1-plugins-bad-free: gstreamer: multiple out-of-bounds reads in pcapparse ipv4/tcp header parsing
GStreamer pcapparse element multiple out-of-bounds read vulnerabilities. In gstpcapparse.c (gst-plugins-bad), multiple issues exist in PCAP record parsing: (1) At line 465-466, srcport/dstport are read from bufproto without verifying sufficient data exists after the IP header for TCP/UDP header fields. (2) At line 485, payloadsize = ippacketlen - ipheadersize - len trusts the ippacketlen field from the IP header. A spoofed value larger than the actual buffer yields a payloadsize exceeding available data. (3) When payloadsize is computed from an untrusted IP length field, downstream gets data from the next PCAP record. Upstream confirmed by maintainer Sebastian Dröge (2026-06-02): "Confirmed, OOB reads. Can only be triggered in specially crafted GStreamer pipelines (as built for debugging purposes) on specially crafted data, very unlikely to cause problems in reality." Fix planned for GStreamer 1.28.4. Upstream issue: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/workitems/5106 (confidential). Reported via PSIRTSUPT-17026 by JUNYI LIU / Moss (moss80199).
Other sources
Multiple out-of-bounds read vulnerabilities were found in GStreamer's pcapparse element. Malformed PCAP records can trigger reads beyond buffer boundaries during IPv4/TCP header parsing. This element is primarily used in debugging pipelines, limiting real-world exposure. A local attacker could trick a user into processing a specially crafted PCAP file, potentially leading to a crash or information disclosure.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GStreamer (gst-plugins-bad / pcapparse element)to a version that resolves this vulnerability.Fixed in 1.28.4 - Compensating control
Do not process PCAP files from untrusted sources. Avoid using the pcapparse element in pipelines that handle untrusted or user-supplied PCAP data (it is primarily used in debugging pipelines). Restrict who can run/debug pipelines that parse PCAP files and ensure only vetted PCAP files are fed to affected pipelines until the patch is applied.
- Operational
Monitor upstream for the planned fix and apply the GStreamer 1.28.4 update to gst-plugins-bad as soon as it is available. Until patched, avoid building or deploying pipelines that include the pcapparse element for untrusted input.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52721?
The severity of CVE-2026-52721 is assessed as medium with a score of 5.3.
How do I fix CVE-2026-52721?
To fix CVE-2026-52721, update to the latest version of GStreamer that addresses the vulnerability.
What is the impact of CVE-2026-52721?
CVE-2026-52721 can lead to multiple out-of-bounds reads that may be triggered by malformed PCAP records.
Who is affected by CVE-2026-52721?
Users of GStreamer gstreamer1-plugins-bad-free that utilize the pcapparse element are potentially affected by CVE-2026-52721.
Can CVE-2026-52721 be exploited remotely?
CVE-2026-52721 requires local attacker access to exploit, primarily through malicious PCAP files.