DEBIAN-CVE-2026-125704: Use After Free
A use-after-free flaw was found in GStreamer core buffer value deserialization. When serialized buffer text contains an invalid character, an error path frees a mapped buffer before unmapping it. Applications that parse untrusted caps or structure data can reach a freed-buffer read and may crash. A network-facing GStreamer Data Protocol receiver can process such caps data without user interaction; further impact has not been established.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/gstreamer1.0to a version that resolves this vulnerability.Fixed in 1.28.3-1
Event History
Frequently Asked Questions
Which deployments are realistically exposed to this issue?
Applications that parse untrusted GStreamer caps or structure data are exposed. Network-facing GStreamer Data Protocol receivers are specifically identified as able to process the malicious caps data without user interaction.
What does an attacker need to trigger the flaw?
An attacker needs to supply serialized buffer text containing an invalid character through a path that causes the application to deserialize untrusted caps or structure data. No privileges or user interaction are required according to the provided severity vector.
What is the expected impact?
The reachable condition is a freed-buffer read that may crash the application, resulting in a denial of service. Further impact beyond a crash has not been established.