Security Advisory 2026-0067

Details

Multiple vulnerabilities in the openjpegdec JPEG 2000 decoder element in gst-plugins-bad.

A heap buffer overflow occurs when decoding JPEG 2000 codestreams whose image region is positioned at a non-zero offset within the format's reference grid. The format allows images to occupy a sub-rectangle of a larger coordinate space, with the top-left corner specified by an origin offset. The decoder allocated output buffers sized to the actual image dimensions, but the pixel copy routines advanced the write pointer by the origin offset before writing the full image. With a non-zero origin, the write cursor was positioned past the end of the allocated buffer and all pixel writes landed out of bounds. In striped decoding mode, the per-stripe coordinate values were used directly without clamping against the negotiated buffer dimensions, allowing attacker-controlled stripe coordinates to trigger out-of-bounds writes. Additionally, the stride multiplication used signed 32-bit arithmetic, which could overflow for large images and produce incorrect pointer offsets.

A memory leak occurs when error paths during stripe decoding skip the buffer unmapping steps. The decode function uses early returns via goto on errors, but the cleanup code at the exit point did not unmap previously mapped input and output buffers, leaving them mapped and leaked.

Impact

A malicious third party could trigger a heap buffer overflow by providing a crafted JPEG 2000 file with a non-zero reference grid origin to an application using the openjpegdec element. This can result in data corruption, crash, denial of service, or potentially arbitrary code execution.

Solution

The gst-plugins-bad 1.28.6 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.6 release

• Release Notes
• GStreamer Plugins Bad 1.28.6

Patches

• Patch