Security Advisory 2026-0052 (CVE-2026-18298)

Details

A heap buffer overflow vulnerability in the gdkpixbufdec element (GdkPixbuf-based image decoder) in gst-plugins-good. The element initializes its output buffer pool based on the dimensions of the first decoded frame and never re-evaluates or reconfigures it when subsequent frames have different dimensions or pixel formats. When processing image sequences where later frames are larger than the first frame, the element acquires undersized output buffers from the stale pool and writes decoded pixel data beyond the buffer boundary, resulting in a heap buffer overflow proportional to the dimension difference.

Impact

A malicious third party could trigger a heap buffer overflow by providing a crafted image sequence with frames of increasing dimensions to an application using the gdkpixbufdec element. This could be triggered through network streams, container files, or image sequences that contain images of differing dimensions processed consecutively, provided the element is the highest-ranked decoder for the image format in question. The overflow could result in a crash, denial of service, data corruption, or arbitrary code execution.

Solution

The gst-plugins-good 1.28.5 release addresses the issue by ensuring the output buffer pool is re-evaluated whenever frame dimensions or pixel format change.

Additionally, the element rank was lowered from SECONDARY to NONE, as the underlying gdk-pixbuf library is not designed to handle untrusted input and the element should not be auto-selected for decoding images from unknown sources. Specialized decoders for common image formats are available at higher ranks, and a proper replacement is being tracked at gst-plugins-rs issue #764.

People using older versions of GStreamer should apply the patch and recompile, or disable the plugin to mitigate the vulnerability.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• CVE-2026-18298

GStreamer 1.28.5 release

• Release Notes
• GStreamer Plugins Good 1.28.5

Patches

• Patch