Security Advisory 2026-0054

Details

A heap buffer overflow vulnerability in the encoding-target loader in gst-plugins-base. The loader passes encoding target names directly to a UTF-8 to ASCII conversion function without validating UTF-8 well-formedness first. The conversion function assumes valid UTF-8 input and iterates over multi-byte sequences without bounds checking. When the input contains a truncated multi-byte UTF-8 sequence at the end of the buffer, the internal UTF-8 iterator advances past the NUL terminator and reads adjacent heap memory. The vulnerability is reachable through the public encoding profile API, which accepts arbitrary byte sequences from callers.

Impact

An application that passes untrusted input to the encoding profile API could trigger a heap buffer overflow by providing a string containing a truncated UTF-8 sequence, potentially resulting in a crash, denial of service, or information disclosure.

Solution

The gst-plugins-base 1.28.5 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.5 release

• Release Notes
• GStreamer Plugins Base 1.28.5

Patches

• Patch