REDHAT-BUG-2569125: Integer Overflow

Q: What input would an attacker need to exploit these issues?

An attacker would need to cause GStreamer to process a malformed MPEG Program Stream file. The vulnerable parsing paths involve the mpegdemux element and the resindvd PES filter.

Q: What impacts should be considered during triage?

The reported impacts include application crashes, denial of service, and potential information disclosure caused by out-of-bounds reads and integer overflows while parsing malformed stream data.

Q: Which version contains the fixes?

The issues are fixed in gst-plugins-bad 1.28.3.

Published Nov 9, 2026

Updated

GStreamer-SA-2026-0024: Malformed MPEG Program Stream files can trigger out-of-bounds reads in the mpegdemux element and resindvd PES filter. The issues include missing bounds checks for DTS/PTS timestamps and PES extension fields, insufficient validation while scanning timestamps, and possible integer overflows in length calculations. Impact may include crashes, denial of service, and information disclosure. Fixed in gst-plugins-bad 1.28.3.

Affected Software

1 affected component

GStreamer gst-plugins-bad<1.28.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade gst-plugins-bad to a version that resolves this vulnerability.
Fixed in 1.28.3

Event History

Nov 9, 2026

Data Sourced

via Red Hat·12:55 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What input would an attacker need to exploit these issues?

An attacker would need to cause GStreamer to process a malformed MPEG Program Stream file. The vulnerable parsing paths involve the mpegdemux element and the resindvd PES filter.

What impacts should be considered during triage?

The reported impacts include application crashes, denial of service, and potential information disclosure caused by out-of-bounds reads and integer overflows while parsing malformed stream data.

Which version contains the fixes?

The issues are fixed in gst-plugins-bad 1.28.3.

REDHAT-BUG-2569125: Integer Overflow

Affected Software

Remediation

Event History

Frequently Asked Questions

What input would an attacker need to exploit these issues?

What impacts should be considered during triage?

Which version contains the fixes?

Company

Resources

Contact

Frequently Asked Questions

What input would an attacker need to exploit these issues?

What impacts should be considered during triage?

Which version contains the fixes?