Security Advisory 2026-0059

Details

An out-of-bounds read vulnerability in the VP9 parser in gst-plugins-bad when parsing VP9 superframe metadata. The parser extracts the per-frame-size byte count and frame count from the superframe header to compute the total superframe index size, but did not validate that the computed index size fits within the provided data buffer. A crafted VP9 superframe with large field values produces an index size exceeding the actual buffer length, causing the pointer arithmetic for the index reader to underflow and subsequent reads to access memory before the start of the buffer.

Impact

A malicious third party could trigger out-of-bounds reads by providing a crafted VP9 superframe with a short buffer and large index size fields, potentially resulting in a crash, denial of service, or limited information disclosure. VP9 is widely used for file-based media (WebM containers), real-time communication (WebRTC), and adaptive streaming (DASH/HLS), making the vulnerability triggerable through file processing pipelines, remote video streams, and live streaming servers.

Solution

The gst-plugins-bad 1.28.5 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.5 release

• Release Notes
• GStreamer Plugins Bad 1.28.5

Patches

• Patch