Security Advisory 2026-0039 (CVE-2026-52718)
| Summary | Assertion in AV1 parser tile data parsing |
| Date | 2026-06-12 |
| Affected Versions | GStreamer gst-plugins-bad < 1.28.4 |
| IDs | GStreamer-SA-2026-0039 CVE-2026-52718 |
Details
A bytes/bits confusion in the AV1 parser in gst-plugins-bad. When parsing tile data within AV1 bitstream units, the parser incorrectly treated a byte-based size value as a bit-based offset when advancing through the bitstream. This caused the parser position to become misaligned, leading to assertion failures or subsequent parsing errors when processing the remaining data.
Impact
A malicious third party could trigger a crash by providing a crafted AV1 media file with tile data in a specific format, resulting in denial of service.
Solution
The gst-plugins-bad 1.28.4 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.