REDHAT-BUG-2486732: Medium severity GStreamer gst-plugins-bad (pcapparse element) vulnerability
GStreamer pcapparse element multiple out-of-bounds read vulnerabilities. In gstpcapparse.c (gst-plugins-bad), multiple issues exist in PCAP record parsing: (1) At line 465-466, srcport/dstport are read from bufproto without verifying sufficient data exists after the IP header for TCP/UDP header fields. (2) At line 485, payloadsize = ippacketlen - ipheadersize - len trusts the ippacketlen field from the IP header. A spoofed value larger than the actual buffer yields a payloadsize exceeding available data. (3) When payloadsize is computed from an untrusted IP length field, downstream gets data from the next PCAP record. Upstream confirmed by maintainer Sebastian Dröge (2026-06-02): "Confirmed, OOB reads. Can only be triggered in specially crafted GStreamer pipelines (as built for debugging purposes) on specially crafted data, very unlikely to cause problems in reality." Fix planned for GStreamer 1.28.4. Upstream issue: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/workitems/5106 (confidential). Reported via PSIRTSUPT-17026 by JUNYI LIU / Moss (moss80199).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GStreamer gst-plugins-bad (pcapparse)to a version that resolves this vulnerability.Fixed in 1.28.4 - Configuration
Build or configure GStreamer without debugging pipeline support, and avoid enabling debug-built pipelines when processing untrusted PCAP data to reduce the ability to trigger the flaw.
GStreamer build/configuration debugging pipeline support = disabled - Compensating control
Do not process untrusted or unauthenticated PCAP files with GStreamer's pcapparse element (especially in debug-built pipelines). Restrict ingestion of PCAP data to trusted sources and isolate any systems that must handle untrusted PCAPs.
- Operational
Monitor GStreamer upstream for the 1.28.4 release and apply the update or later as soon as it is available. After updating, validate pcapparse-related pipelines to ensure they correctly handle PCAP inputs.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2486732?
The severity of REDHAT-BUG-2486732 is classified as medium with a rating of 4.
What are the main issues in REDHAT-BUG-2486732?
REDHAT-BUG-2486732 involves multiple out-of-bounds read vulnerabilities in the GStreamer pcapparse element during PCAP record parsing.
How do I fix REDHAT-BUG-2486732?
To address REDHAT-BUG-2486732, it is recommended to update the GStreamer gst-plugins-bad to the latest version that includes the necessary patches.
What software is affected by REDHAT-BUG-2486732?
The affected software is GStreamer gst-plugins-bad specifically the pcapparse element.
When was REDHAT-BUG-2486732 published?
REDHAT-BUG-2486732 was published on June 9, 2026.