Security Advisory 2026-0037 (CVE-2026-52717)

Details

An invalid free vulnerability in the AV protocol implementation of gst-libav. When closing the pipe used for AV I/O operations, the close handler freed a pointer pointing into the middle of a larger allocation owned by the demuxer element, corrupting heap metadata. This is always triggered when using the gst-libav demuxer in push mode.

Impact

A malicious third party could trigger heap corruption by using the gst-libav demuxer in push mode, potentially resulting in a crash or denial of service.

Solution

The gst-libav 1.28.4 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• CVE-2026-52717

GStreamer 1.28.4 release

• Release Notes
• GStreamer LibAV 1.28.4

Patches

• Patch