UBUNTU-CVE-2026-125040: Medium severity ubuntu/gst-plugins-base1.0 vulnerability
A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle markup, the parser repeatedly searches the remaining text with unanchored regular expressions. A crafted subtitle cue with a long line of unmatched markup-like text can force quadratic CPU use and make a GStreamer-based application unresponsive.
Affected Software
Event History
Frequently Asked Questions
Which deployments are most exposed?
GStreamer-based applications that parse SRT or WebVTT subtitle content are exposed to denial-of-service risk when processing crafted subtitle cues. The impact is application unresponsiveness caused by excessive CPU use.
Does exploitation require authentication or user interaction?
The severity vector indicates no privileges are required, but user interaction is required. The attack vector is network-based and the affected confidentiality and integrity impacts are listed as none.