SB2026080644 - Multiple vulnerabilities in gst-plugins-bad

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080644

SB2026080644 - Multiple vulnerabilities in gst-plugins-bad

Published: August 6, 2026 Updated: August 6, 2026

Security Bulletin ID SB2026080644
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 16
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 56% Low 44%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 16 vulnerabilities.


1) Out-of-bounds read (CVE-ID: CVE-2026-53703)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the rmdemux and rademux demuxers when parsing malformed RealMedia files. A remote attacker can provide a crafted RealMedia file to disclose sensitive information.

The issue occurs while parsing file headers, stream properties, and audio packets.


2) Integer overflow (CVE-ID: CVE-2026-53704)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow in the rmdemux and rademux demuxers when parsing malformed RealMedia files. A remote attacker can provide a crafted RealMedia file to cause a denial of service.

The issue stems from the use of signed integer types for size and length parameters during size calculations and index operations.


3) Out-of-bounds read (CVE-ID: CVE-2026-52719)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.

The vulnerability exists due to out-of-bounds read in the VA JPEG decoder segment parser when parsing crafted JPEG data. A remote attacker can provide a crafted JPEG file with undersized or truncated segments to disclose sensitive information or cause a denial of service.

User interaction is required to open or process a crafted JPEG file.


4) Input validation error (CVE-ID: CVE-2026-52718)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the AV1 parser when parsing tile data within AV1 bitstream units. A remote attacker can provide a crafted AV1 media file to cause a denial of service.

User interaction is required to open or process a crafted AV1 media file.


5) NULL pointer dereference (CVE-ID: N/A)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to null pointer dereference in gst-libav demuxer cleanup path when opening a corrupted or specially crafted media file. A remote attacker can supply a corrupted or specially crafted media file to cause a denial of service.

User interaction is required to process the crafted media file.


6) Improper Resource Shutdown or Release (CVE-ID: N/A)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in gst-libav demuxer error cleanup path when opening a corrupted or specially crafted media file. A remote attacker can supply a corrupted or specially crafted media file to cause a denial of service.

Repeated failed open attempts may lead to resource exhaustion through memory leaks. User interaction is required to process the crafted media file.


7) Release of invalid pointer or reference (CVE-ID: CVE-2026-52717)

CWE-ID: CWE-763 - Release of invalid pointer or reference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to invalid free in the AV protocol pipe close handler in gst-libav when using the gst-libav demuxer in push mode. A remote attacker can supply crafted media that is processed with the gst-libav demuxer to cause a denial of service.

The issue is triggered when the pipe used for AV I/O operations is closed.


8) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.

The vulnerability exists due to out-of-bounds read in the sbcparse element when parsing crafted SBC audio frame headers and multi-frame buffers. A remote attacker can provide a crafted SBC audio file with undersized frames to disclose sensitive information or cause a denial of service.

User interaction is required to process a crafted SBC audio file.


9) Integer overflow (CVE-ID: CVE-2026-53705)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow in the wavpackdec element when processing malformed WavPack audio files. A remote attacker can trick the victim into opening a crafted audio file to cause a denial of service.


10) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the mDVDsub subtitle parser when parsing a crafted subtitle file with an invalid frame rate value. A remote attacker can provide a specially crafted mDVDsub subtitle file to cause a denial of service.

User interaction is required to open or process the crafted subtitle file.


11) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose limited memory contents.

The vulnerability exists due to out-of-bounds read in the ID3v2 parser when processing crafted RVA2 ID3v2 tags in a media file. A remote attacker can provide a specially crafted media file to disclose limited memory contents.

The out-of-bounds read is limited to up to 2 bytes beyond the actual frame buffer.


12) Write-what-where Condition (CVE-ID: N/A)

CWE-ID: CWE-123 - Write-what-where Condition

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to corrupt media data.

The vulnerability exists due to modification of const data in the ID3v2 parser when handling custom ID3v2 frames. A remote attacker can provide a specially crafted media file to corrupt media data.

This can lead to parsing errors.


13) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service or disclose sensitive information.

The vulnerability exists due to out-of-bounds read in XMP tag parser when parsing malformed XMP metadata. A remote attacker can provide a crafted media file with malformed XMP metadata to cause a denial of service or disclose sensitive information.


14) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to out-of-bounds write in XMP tag parser when parsing malformed XMP metadata. A remote attacker can provide a crafted media file with malformed XMP metadata to cause memory corruption.

The out-of-bounds write is limited to up to 1 byte.


15) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.

The vulnerability exists due to out-of-bounds read in the RTCP SDES packet parser when parsing crafted RTCP packets with invalid SDES data. A remote attacker can send a specially crafted RTCP packet to disclose sensitive information or cause a denial of service.

The issue involves missing bounds validation when iterating over SDES items and entries, and an incorrect packet length calculation that underestimates the total packet size by 4 bytes.


16) Integer overflow (CVE-ID: N/A)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.

The vulnerability exists due to integer overflow and truncation in the mxfdemux element when parsing crafted MXF media files. A remote attacker can trick the victim into opening a crafted file to disclose sensitive information or cause a denial of service.

User interaction is required to process a crafted MXF media file.


Remediation

Install update from vendor's website.

References