Security Advisory 2026-0014 (CVE-2026-119729)
| Summary | Integer overflow in AV1 LEB128 parser |
| Date | 2026-04-07 |
| Affected Versions | GStreamer gst-plugins-base < 1.28.2, gst-plugins-bad < 1.28.2 |
| IDs | GStreamer-SA-2026-0014 CVE-2026-119729 |
Details
Integer overflow in the AV1 LEB128 parser in gst-plugins-base typefind functions and gst-plugins-bad AV1 video parsers when handling malformed AV1 bitstreams. The parser incorrectly handles signed 32-bit integer values and fails to properly validate LEB128 encoded values according to the AV1 specification.
Impact
It is possible for a malicious third party to trigger a crash in the application, resulting in denial of service, when processing malicious AV1 media files or streams.
Solution
The gst-plugins-base 1.28.2 and gst-plugins-bad 1.28.2 releases address the issue. People using older versions of GStreamer should apply the patch and recompile.