Security Advisory 2026-0069

Details

A heap buffer overflow in the FFmpeg demuxer wrapper in gst-libav. The demuxer maintains a fixed-size array to store information about each stream in the media file, indexed by the stream number assigned by the underlying codec library. When processing media files containing more streams than the array can hold, the stream number is used to access the array without bounds validation, causing out-of-bounds reads and writes past the array boundaries. This corrupts adjacent data structures and heap memory beyond the object instance.

Impact

A malicious third party could trigger a heap buffer overflow by providing a crafted media file with more than 20 streams, potentially resulting in data corruption, application crash, denial of service, or arbitrary code execution.

Solution

The gst-libav 1.28.6 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.6 release

• Release Notes
• GStreamer Libav 1.28.6

Patches

• Patch