REDHAT-BUG-2486353: High severity GStreamer gst-plugins-bad vulnerability
GStreamer VA JPEG decoder out-of-bounds read vulnerability. In gstjpegparser.c (gst-plugins-bad), the gstjpegparse() function reads a segment length from the bitstream without validating it against available data. The VA JPEG decoder path trusts this untrusted seg->size value and constructs a byte reader over an inflated range, reading past the buffer. The code's own comment explicitly acknowledges this: "a valid segment may be returned with a length that exceeds the available data." Upstream confirmed by maintainer Sebastian Dröge (2026-06-02), who noted it is "actually a bug in the VA JPEG decoder in gst-plugins-bad" and "an OOB read that could lead to a crash or possibly information disclosure." Fix planned for GStreamer 1.28.4 or 1.28.5. Upstream issue: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/workitems/5104 (confidential). Reported via PSIRTSUPT-17026 by JUNYI LIU / Moss 1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GStreamer gst-plugins-bad (GStreamer VA JPEG decoder)to a version that resolves this vulnerability.Fixed in 1.28.4 - Upgrade
Upgrade
GStreamer gst-plugins-bad (GStreamer VA JPEG decoder)to a version that resolves this vulnerability.Fixed in 1.28.5
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2486353?
The severity of REDHAT-BUG-2486353 is high, rated at 7.
What does REDHAT-BUG-2486353 entail?
REDHAT-BUG-2486353 describes an out-of-bounds read vulnerability in the GStreamer VA JPEG decoder due to insufficient validation of segment lengths.
How do I fix REDHAT-BUG-2486353?
To fix REDHAT-BUG-2486353, update to the latest version of GStreamer gst-plugins-bad that addresses the vulnerability.
Are there any known exploits for REDHAT-BUG-2486353?
As of the publication date, no specific exploits for REDHAT-BUG-2486353 have been reported.
Who is affected by REDHAT-BUG-2486353?
Users and applications utilizing the vulnerable GStreamer gst-plugins-bad with the VA JPEG decoder are affected by REDHAT-BUG-2486353.