UBUNTU-CVE-2026-125706: Medium severity ubuntu/gst-plugins-bad1.0 vulnerability
A flaw was found in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin. The PES header parsers do not adequately check remaining data before reading timestamps and optional header fields. Opening a specially crafted MPEG Program Stream file can cause an out-of-bounds read and potentially crash the application, resulting in a denial of service.
Affected Software
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Applications on Ubuntu that use gst-plugins-bad1.0 and process MPEG Program Stream content may be exposed, particularly if they open files from untrusted sources. The affected components are the MPEG Program Stream demuxer and the resindvd DVD-playback plugin.
What must an attacker do to trigger the flaw?
An attacker needs to cause the application to open a specially crafted MPEG Program Stream file. The malformed PES header can cause an out-of-bounds read while timestamps or optional header fields are parsed.
What is the expected impact of successful exploitation?
Successful exploitation can potentially crash the application, causing a denial of service. The provided information does not establish impacts beyond an application crash.