A flaw was found in GStreamer's gst-plugins-good MOV/MP4 demuxer. When ...

GStreamer-SA-2026-0025: Insufficient validation in MOV/MP4 demuxer uncompressed video handling. Advisory details and affected version range were not available from the page fetch; the OSIM record is based on the published advisory title and date.

A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's ...

GStreamer-SA-2026-0023: The SRT/WebVTT subtitle parser (subparse) uses regular-expression matching and replacement with quadratic time complexity for long lines. A crafted subtitle file can cause excessive CPU use and application unresponsiveness. Fixed in gst-plugins-base 1.28.2.

A flaw was found in GStreamer's adaptive streaming demuxers (HLS, DASH ...

A flaw was found in GStreamer's gst-plugins-bad package. A use of unin ...

gst-plugins-bad (GstCodecparsers library) contains a use-of-uninitialized-variable (CWE-457) in gsth265parsevps() in gst-libs/gst/codecparsers/gsth265parser.c. When a VPS NAL unit declares more than one HRD parameter set (vpsnumhrdparameters >= 2), the workaround loop at lines 2152-2165 processes each extra set (i >= 1) into a local GstH265HRDParams hrdparams variable declared at line 2155 that is never zero-initialized before being passed to gsth265parsehrdparameters(). That function sets only three fields to defaults and leaves all other fields as stack garbage, which steers further parsing (including gsth265parsesublayerhrdparameters() at line 439). Bug introduced in upstream GStreamer 1.16.0 (commit 52f2054386). Fix targeted for upstream 1.28.9 (not yet merged as of 2026-10-30; private gstreamer-security MR !132). GStreamer security advisory SA-2026-0094. PSIRT support ticket PSIRTSUPT-29600. Reporter: Sebastian Dröge, Centricular Ltd.

A flaw was found in GStreamer's MXF demuxer plugin (gst-plugins-bad). ...

gst-plugins-bad mxfdemux (gst/mxf/mxfdemux.c) contains at least five heap-buffer-overflow READ paths introduced in GStreamer 1.20.0 by the index-table refactor (commit ac483b2384, 2021-07-21). Root cause CWE-129: findeditentry() and findentryforoffset() use deltaid and slice as array indices without validating against ndeltaentries and slicecount.

Affected upstream GStreamer versions: >= 1.20.0, fixed in 1.28.9 (unreleased as of 2026-10-30). Upstream advisory SA-2026-0093; fix in gstreamer-security MR !131.

PSIRT ticket: PSIRTSUPT-29601.

Reporter: Sebastian Dröge, Centricular Ltd.

GStreamer-SA-2026-0015 reports integer overflows and division by zero in the jp2kdecimator element of gst-plugins-bad when it processes malformed JPEG 2000 codestreams. Insufficient bounds checks in size validation and tile configuration parsing permit multiplication overflows and a zero tile dimension to reach division. A crafted JPEG 2000 stream or media file can crash the GStreamer application, causing denial of service. Upstream identifies gst-plugins-bad versions before 1.28.2 as affected and 1.28.2 as the fixed release. The advisory was published on 2026-04-07 and does not identify the original reporter or supply a public proof of concept. This record is based on the upstream advisory and release notes; no independent source review or dynamic reproduction has been completed. Advisory: https://gstreamer.freedesktop.org/security/sa-2026-0015.html

gst-plugins-good FLV demuxer (gst/flv/gstflvdemux.c): missing GstByteReader return checks in gstflvdemuxparsetagaudio/video before 1.28.2 when parsing Enhanced RTMP v2 tags; malformed FLV can crash the process (DoS). Fixed in gst-plugins-good 1.28.2 (MR !11244). Upstream GStreamer-SA-2026-0020 (2026-04-07). CVE CVE-2026-119843.

GStreamer Security Advisory GStreamer-SA-2026-0017 reports an integer overflow in the gst-plugins-bad H.266/VVC parser while parsing profile, tier, and level fields from malformed H.266 streams. The resulting stack-based buffer overflow may crash an application processing malicious media and could possibly allow code execution. Upstream lists gst-plugins-bad versions 1.25.1 through versions before 1.28.2 as affected; version 1.28.2 contains the fix. The local verification report confirmed the code pattern by static analysis but did not confirm the exact exploit path.

gst-plugins-bad contains a NULL pointer dereference in the H.264 Subset SPS (Sequence Parameter Set) MVC (Multiview) extension parser. The vulnerable function is gsth264parsespsmvcdata() in subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gsth264parser.c. The function sets sps->extensiontype = GSTH264NALEXTENSIONMVC at line 2071 before any heap allocations (mvc->view, mvc->levelvalue, applicableop, targetviewid). If any subsequent READ macro fails (truncated bitstream, out-of-range value), control jumps to the 'error:' label at line 2139 which calls gsth264spsclear(sps). This dispatches to gsth264spsmvcclear(sps) because extensiontype is already MVC. The cleanup function iterates over heap-allocated sub-structures that may be partially or wholly uninitialized. A NULL dereference can occur when the cleanup traverses these structures.

Affected upstream versions: gst-plugins-bad < 1.28.2. Fixed in gst-plugins-bad 1.28.2 (upstream MR !11240).

Upstream: GStreamer-SA-2026-0013 (2026-04-07).

GStreamer's gst-plugins-bad provides the H.265 (HEVC) bitstream parser in subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gsth265parser.c. In the function gsth265parsespsext() at approximately line 2297, when parsing the SPS SCC (Screen Content Coding) extension, the code computes the upper bound for spsnumpalettepredictorinitializerminus1 as 'palettemaxsize + deltapalettemaxpredictorsize - 1'. If an attacker crafts a bitstream where both palettemaxsize and deltapalettemaxpredictorsize are 0 (legal values per their individual READUEMAX constraints), this subtraction produces 0xFFFFFFFF via unsigned integer underflow. The READUEMAX macro checks 'val > max' using guint32 comparison, so 0xFFFFFFFF as max accepts any guint32 value. The field spsnumpalettepredictorinitializerminus1 is stored in a guint8, so the value is truncated to 0..255. If the truncated value exceeds 127, the subsequent loop 'for (i = 0; i < num; i++) READUINT32(nr, spspalettepredictorinitializer[comp][i], numbits)' writes past the end of the guint32 spspalettepredictorinitializer[3][128] array, causing a heap buffer overflow into adjacent GstH265SPSSCCExtensionParams and GstH265SPS struct members. This corrupts the GstH265SPS object stored in the parser's static sps[] array.

Affected versions: gst-plugins-bad < 1.28.1. Fix: gst-plugins-bad 1.28.1 adds a guard 'if (palettemaxsize + deltapalettemaxpredictorsize == 0) goto error' before the bound computation. Advisory: GStreamer-SA-2026-0012. Reporter: GStreamer project (upstream self-reported).

A flaw was found in GStreamer's gst-plugins-good, specifically in the ...

GStreamer gst-plugins-good ships the rtph264depay element (gst/rtp/gstrtph264depay.c). MTAP16 (NAL type 26) and MTAP24 (NAL type 27) support was added in gst-plugins-good 1.28.0 (upstream commit 367cda03c9, 2025-10-08).

In gstrtph264depayprocess() the variable payloadlen is declared as gint (signed 32-bit). For the MTAP16/MTAP24 branch (lines 1380-1471), the code strips the 1-byte NAL type header (line 1387) and then unconditionally strips the 2-byte decoding-order-number base (DON base, line 1396) without first checking that at least 2 bytes remain. When the RTP payload is truncated (e.g., only 1 byte — just the NAL type), payloadlen goes negative (e.g., 1-1-2 = -2).

Bug 1 — Wrong loop guard (line 1398): aggregationunitsize is gsize (unsigned). The comparison 'while (payloadlen > aggregationunitsize)' performs an unsigned promotion of the signed payloadlen. A negative payloadlen (e.g., -2) becomes a very large unsigned value (0xFFFFFFFE on 32-bit), so the loop condition is TRUE and the loop body executes even though the packet is exhausted.

Bug 2 — Broken clamping (line 1427): Inside the loop, nalusize is read via GSTREADUINT16BE() from the payload pointer that is already past the end of the packet buffer (OOB heap read #1). The subsequent clamping guard 'if (nalusize > payloadlen)' is also a signed/unsigned comparison: nalusize is guint, payloadlen is gint (still negative). Negative payloadlen is promoted to a huge unsigned value, so the condition evaluates FALSE and nalusize is NOT clamped. nalusize may be up to 65535.

Bug 3 — memcpy from OOB (line 1441): memcpy(map.data + sizeof(syncbytes), payload, nalusize) reads nalusize (up to 65535) bytes from payload, which points past the end of the actual packet. This is the primary heap-buffer-over-read confirmed by ASan: READ of 48830 bytes at gstrtph264depay.c:1432.

The allocated output buffer (outbuf) has exactly nalusize+4 bytes; the DESTINATION is valid. Only the SOURCE is OOB. The content is then placed into the depayloaded output GstBuffer and forwarded downstream. In relay/transcode pipelines this becomes observable information disclosure. In all pipelines, the OOB read is likely to crash the process (SIGSEGV) when the read range extends into unmapped memory.

Affected: gst-plugins-good 1.28.0 through 1.28.8. Fixed in: 1.28.9 (unreleased as of 2026-10-28, private MR gstreamer-security !136). GStreamer advisory SA-2026-0095.

Reporter: Claude (Anthropic), Ada Logics. PSIRT ticket: PSIRTSUPT-29444.

A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager thumbnailing service that uses GStreamer autoplugging, the pipeline description is parsed and instantiated without restriction on which elements may be used or which properties may be set. A remote attacker who can deliver a crafted project file to a victim's system can trigger reading or writing of arbitrary local files, issue outbound network requests to attacker-controlled servers, or cause the application to crash. Under certain conditions the file-write capability may be leveraged to achieve code execution.

A flaw was found in the GStreamer ASF demuxer (gst-plugins-ugly). The Simple Index object parser reads an attacker-controlled entry count from the media and allocates an index table of that size with gnew0 without first clamping the count to the bytes remaining in the object. A crafted ASF, WMV, or WMA file can therefore request a very large heap allocation (on the order of tens of gigabytes of address space). When the allocation cannot be satisfied, or under memory limits, the application can abort or be terminated, resulting in denial of service. The parse loop stops when payload is exhausted, and GLib allocation helpers do not return an undersized buffer; this is not a heap buffer overflow.

A flaw was found in the GStreamer ASF demuxer (gst-plugins-ugly). The Simple Index object parser reads an attacker-controlled entry count from the media and allocates an index table of that size with gnew0 without first clamping the count to the bytes remaining in the object. A crafted ASF, WMV, or WMA file can therefore request a very large heap allocation (on the order of tens of gigabytes of address space). When the allocation cannot be satisfied, or under memory limits, the application can abort or be terminated, resulting in denial of service. The parse loop stops when payload is exhausted, and GLib allocation helpers do not return an undersized buffer; this is not a heap buffer overflow.

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemuxparseuuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents.

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemuxparsechnl function may read past the end of a global array, potentially leading to information disclosure.

This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of RTP payload elements. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of RTP payload elements. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of RTP payload elements. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31143.

A flaw was found in GStreamer's H.266 codec parser library (libgstcodecparsers). An out-of-bounds write vulnerability exists in the DCI parsing function, where a reserved field value is incorrectly accepted, causing the parser to write beyond the bounds of an internal structure. An attacker could exploit this by providing a specially crafted H.266 bitstream to a third-party application that uses this library API, potentially causing a crash or memory corruption. No standard GStreamer pipeline element currently invokes the affected code path.

GStreamer's H.266 (VVC) codec parser library (libgstcodecparsers) contains an out-of-bounds write vulnerability in gsth266parserparsedci() in gsth266parser.c (line 4812). CHECKALLOWEDMAX(dci->numptlsminus1, 15) allows value 15, but GstH266DCI.profiletierlevel[] has only 15 elements (indices 0..14). When dcinumptlsminus1 is 15, the loop writes past the structure via gsth266parseprofiletierlevel(). H.266 spec defines valid range 0..14; 15 is reserved. Fix: change bound to 14. Introduced in GStreamer 1.26. No in-tree element calls this API. Upstream report awaiting triage, no public patch. Reporter: Bruno Fournier. Tested on 1.29.2 (4cb910d) with ASan. PSIRT: PSIRTSUPT-24646.

A flaw was found in the GStreamer multimedia framework's ASF muxer plugin (asfmux). When writing string metadata tags containing Unicode characters outside the Basic Multilingual Plane (such as emoji) to an ASF container, the plugin incorrectly calculates the buffer size needed for the UTF-16LE representation. The size calculation assumes each Unicode code point requires 2 bytes, but non-BMP characters require 4 bytes (surrogate pairs). This leads to a heap out-of-bounds write when the actual UTF-16LE conversion is written into the undersized buffer. An attacker could exploit this by providing media with crafted metadata tags to an application that transcodes or remuxes to ASF format while preserving metadata, potentially causing a denial of service or limited memory corruption.

GStreamer's asfmux plugin (gst-plugins-bad) contains a heap out-of-bounds write in the ASF header buffer allocation path. The functions contentdescriptioncalcsizefortag() (line 429) and addmetadatatagsize() (line 539) in subprojects/gst-plugins-bad/gst/asfmux/gstasfmux.c compute the UTF-16LE buffer size for string metadata tags using the formula 2 (1 + gutf8strlen(text, -1)). This counts Unicode code points and assumes each maps to one 16-bit UTF-16 code unit. However, non-BMP characters (U+10000 and above, e.g. emoji) require UTF-16 surrogate pairs (4 bytes per character). The write path in gstasfmuxwritestringwithsize() (line 881) uses gconvert() which produces the correct (larger) UTF-16LE byte count. The header buffer is allocated at gstasfmuxstartfile() (line 1332) using the pre-computed sizes. The resulting under-allocation is 2 bytes per non-BMP code point. The overflowing bytes are attacker-derived UTF-16LE content written via memcpy() at line 898.

The issue affects GStreamer versions containing the asfmux plugin in gst-plugins-bad. Reproduced at commit 4cb910d273bef5445c90e77e7b781ab99e236e1f (main branch). The affected size calculation is unchanged on current main.

Fix: Not yet available upstream (reported privately to GStreamer security team, awaiting triage).

Reporter: Bruno Fournier (xxtqqtx) PSIRT Ticket: PSIRTSUPT-24645

A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read of up to 244 bytes, which is then included in the downstream caption output. An attacker could exploit this by tricking a user into opening a malicious media file, potentially resulting in disclosure of adjacent heap memory or application crash.

GStreamer gst-plugins-good contains a vulnerability in the MOV/MP4 demuxer (qtdemux) closed-caption parser. In the extractccfromdata() function in subprojects/gst-plugins-good/gst/isomp4/qtdemux.c, when parsing a CEA-608 caption sample containing two atoms (cdat/cdt2), the bounds check for the second atom at line 6426 computes 'atomlength + newatomlength' using 32-bit unsigned arithmetic (both are guint32). An attacker can craft the second atom's length (newatomlength) such that this addition wraps around to a small value, bypassing the bounds check. The value 'newatomlength - 8' is then passed to converttos3341a() as a guint8 parameter (ccpairsize), truncating a large 32-bit value to at most 244 bytes. This causes converttos3341a() to read up to 244 bytes beyond the valid caption sample buffer, and the out-of-bounds heap data is included in the downstream caption output stream. Versions prior to gst-plugins-good 1.28.7 are affected. Fixed in gst-plugins-good 1.28.7. Security Advisory: GStreamer-SA-2026-0079. Upstream MR: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/mergerequests/12433. Reported by Seonwook Kim. PSIRT ticket: PSIRTSUPT-23503.