Security Advisory 2026-0015 (CVE-2026-XXXX pending)

Details

Integer overflows and division by zero in the JPEG 2000 decimator in gst-plugins-bad when handling malformed JPEG 2000 codestreams. The vulnerabilities occur in size validation checks and tile configuration parsing, where insufficient bounds checking allows integer overflows during multiplication operations and division by zero when tile dimensions are invalid.

Impact

A malicious third party could trigger a crash in the application, resulting in denial of service, when processing malicious JPEG 2000 media files.

Solution

The gst-plugins-bad 1.28.2 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• CVE-2026-XXXX (pending)

GStreamer 1.28.2 release

• Release Notes
• GStreamer Plugins Bad 1.28.2

Patches

• Patch