DEBIAN-CVE-2026-125706: Medium severity debian/gst-plugins-bad1.0 vulnerability

Q: What must an attacker do to trigger this issue?

An attacker would need to persuade a user or application to open a specially crafted MPEG Program Stream file. Exploitation requires user interaction and is locally triggered.

Q: Which components are implicated?

The affected parsing logic is in the gst-plugins-bad MPEG Program Stream demuxer and the resindvd DVD-playback plugin.

Q: What is the expected impact?

A malformed file can cause an out-of-bounds read while parsing PES timestamps or optional header fields, potentially crashing the application and causing denial of service.

Published Nov 10, 2026

Updated

A flaw was found in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin. The PES header parsers do not adequately check remaining data before reading timestamps and optional header fields. Opening a specially crafted MPEG Program Stream file can cause an out-of-bounds read and potentially crash the application, resulting in a denial of service.

Affected Software

3 affected componentsFixes available

debian/gst-plugins-bad1.0*

debian/gst-plugins-bad1.0<1.28.3-1

1.28.3-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/gst-plugins-bad1.0 to a version that resolves this vulnerability.
Fixed in 1.28.3-1

Event History

Nov 10, 2026

CVE Published

via OSV·12:17 PM

Data Sourced

via OSV·12:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What must an attacker do to trigger this issue?

An attacker would need to persuade a user or application to open a specially crafted MPEG Program Stream file. Exploitation requires user interaction and is locally triggered.

Which components are implicated?

The affected parsing logic is in the gst-plugins-bad MPEG Program Stream demuxer and the resindvd DVD-playback plugin.

What is the expected impact?

A malformed file can cause an out-of-bounds read while parsing PES timestamps or optional header fields, potentially crashing the application and causing denial of service.

DEBIAN-CVE-2026-125706: Medium severity debian/gst-plugins-bad1.0 vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker do to trigger this issue?

Which components are implicated?

What is the expected impact?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to trigger this issue?

Which components are implicated?

What is the expected impact?