UBUNTU-CVE-2026-125704: Use After Free
A use-after-free flaw was found in GStreamer core buffer value deserialization. When serialized buffer text contains an invalid character, an error path frees a mapped buffer before unmapping it. Applications that parse untrusted caps or structure data can reach a freed-buffer read and may crash. A network-facing GStreamer Data Protocol receiver can process such caps data without user interaction; further impact has not been established.
Affected Software
Event History
Frequently Asked Questions
Which deployments are most exposed?
Applications that parse untrusted GStreamer caps or structure data are exposed. Network-facing GStreamer Data Protocol receivers are specifically identified as able to process the affected caps data without user interaction.
What must an attacker provide to trigger the flaw?
The attacker must cause the application to deserialize serialized buffer text containing an invalid character. This reaches an error path that frees a mapped buffer before it is unmapped, leading to a read from freed memory.
Is user interaction required for network-accessible receivers?
No. A network-facing GStreamer Data Protocol receiver can process the malicious caps data without user interaction.
What impact is confirmed?
The described impact is a freed-buffer read that may crash the application. Further impact has not been established.