Security Advisory 2026-0060

Details

A stack-based out-of-bounds write vulnerability in the ccconverter element (closed caption converter) in gst-plugins-bad. When converting CEA608 raw data to CEA708 CDP format, the element passed the full input buffer size directly to the internal conversion function without validation. The conversion function uses fixed-size stack buffers sized according to the maximum expected CEA608 data length. Input buffers exceeding this maximum caused writes beyond the stack buffer boundaries. The fix truncates the input length to the maximum expected size before processing and adds internal bounds validation as a defense-in-depth measure.

Impact

A malicious third party could trigger a stack-based out-of-bounds write by providing a crafted media file containing oversized CEA608 closed caption data, potentially resulting in a crash, denial of service, or arbitrary code execution.

Solution

The gst-plugins-bad 1.28.5 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.5 release

• Release Notes
• GStreamer Plugins Bad 1.28.5

Patches

• Patch