REDHAT-BUG-2486328: Medium severity GStreamer gst-plugins-bad vulnerability
GStreamer AV1 tilelistobu parser abort vulnerability. The gstav1parserparsetilelistobu() function in gstav1parser.c (gst-plugins-bad) passes a byte count to gstbitreaderskip(), which expects a bit count. This causes parser desynchronization and a deterministic gassert abort when processing a specially crafted AV1 media file. A 21-byte test case is sufficient to trigger the crash. Upstream confirmed by maintainer Sebastian Dröge (2026-06-02). Fix planned for GStreamer 1.28.4 or 1.28.5. Upstream issue: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/workitems/5103 (confidential). Reported via PSIRTSUPT-17026 by JUNYI LIU / Moss 1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GStreamer gst-plugins-bad (gstav1parser / gst_av1_parser_parse_tile_list_obu)to a version that resolves this vulnerability.Fixed in 1.28.4 - Upgrade
Upgrade
GStreamer gst-plugins-bad (gstav1parser / gst_av1_parser_parse_tile_list_obu)to a version that resolves this vulnerability.Fixed in 1.28.5 - Compensating control
Until a fixed GStreamer version is deployed, avoid processing specially crafted AV1 media files on affected systems (e.g., restrict AV1 input sources).
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2486328?
The severity of REDHAT-BUG-2486328 is medium, rated at 4.
How does the REDHAT-BUG-2486328 vulnerability affect GStreamer?
The REDHAT-BUG-2486328 vulnerability causes parser desynchronization and leads to a deterministic g_assert abort in the GStreamer AV1 tile_list_obu parser.
How do I fix REDHAT-BUG-2486328?
To fix REDHAT-BUG-2486328, update to the latest version of GStreamer gst-plugins-bad where the vulnerability has been addressed.
What component of GStreamer is affected by REDHAT-BUG-2486328?
The GStreamer component affected by REDHAT-BUG-2486328 is the AV1 tile_list_obu parser implemented in the gstav1parser.c file.
Is the REDHAT-BUG-2486328 vulnerability exploitable?
While REDHAT-BUG-2486328 is considered a medium-severity vulnerability, it may lead to application crashes, indicating a potential avenue for denial of service.