Security Advisory 2026-0058 (CVE-2026-2920 follow-up)

Details

An out-of-bounds read vulnerability in the ASF demuxer in gst-plugins-ugly. The demuxer lacked sufficient bounds validation when parsing payload extension data from packet replicated data. The replicated data length field from packet headers could exceed the fixed 256-byte buffer size, and the bounds checks used the unclamped length value, allowing reads beyond the buffer boundary when processing multiple payload extensions with cumulative offsets. Additionally, the TIMING extension type read eight bytes without validating that sufficient data was available.

Impact

A malicious third party could trigger out-of-bounds reads by providing a crafted ASF or WMV file, potentially resulting in a crash, denial of service, or information disclosure.

Solution

The gst-plugins-ugly 1.28.5 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• CVE-2026-2920

GStreamer 1.28.5 release

• Release Notes
• GStreamer Plugins Ugly 1.28.5

Patches

• Patch