Security Advisory 2026-0065

Details

An integer overflow vulnerability in the vendored LZO1X decompressor used by the Matroska (MKV/WebM) demuxer in gst-plugins-good. The decompressor accumulates run lengths from the compressed stream into a signed 32-bit integer without bounding the value. A compressed stream containing a sufficiently long sequence of zero bytes (approximately 8.4 million or more) causes the accumulator to overflow past the maximum representable value into a negative value. This negative length is then passed to the internal copy functions, where bounds checks comparing the signed integer against unsigned buffer offsets fail to trigger. The negative value is implicitly converted to a very large unsigned value during the memory copy operation, resulting in a heap buffer overflow writing well past the decompression output buffer.

The vulnerability affects Matroska and WebM files with tracks using LZO1X compression. This is related to CVE-2014-4610 in FFmpeg, which addressed the same issue in the upstream LZO1X decoder. GStreamer's vendored copy of the decoder was never updated with this fix. A previous advisory (SA-2022-0002, CVE-2022-1924) addressed size accounting around the decompressor but did not fix the integer overflow in the length decoding logic.

Impact

A malicious third party could trigger a heap buffer overflow by providing a crafted Matroska or WebM file with LZO1X-compressed data. Since the Matroska demuxer is auto-plugged by playbin, decodebin, and gst-discoverer pipelines, merely opening or previewing such a file is sufficient to trigger the vulnerability. This could result in application crash, denial of service, data corruption, or arbitrary code execution.

Solution

The gst-plugins-good 1.28.5 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.5 release

• Release Notes
• GStreamer Plugins Good 1.28.5

Patches

• Patch