Security Advisory 2026-0049

Details

A heap buffer overflow vulnerability in the mpeg4videoparse element (MPEG-4 Video parser) in gst-plugins-bad. When processing Visual Sequence Start packets, the parser passes an incorrect length value to the profile and level extraction functions. The offset into the buffer was used as the length parameter instead of the remaining packet size, causing the codec utility functions to read one byte past the end of the heap-allocated buffer when the packet size is small.

Impact

A malicious third party could potentially trigger a crash by providing a crafted MPEG-4 Visual stream (DivX/Xvid), resulting in denial of service.

Solution

The gst-plugins-bad 1.28.5 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.5 release

• Release Notes
• GStreamer Plugins Bad 1.28.5

Patches

• Patch