Security Advisory 2026-0071

Details

Multiple vulnerabilities in the dvdsubdec element (DVD subpicture decoder) in gst-plugins-ugly when processing DVD subpicture streams.

The decoder extracts display rectangle coordinates from the subpicture stream without validating them against the output frame dimensions. The coordinate values were passed directly to the renderer, which writes decoded pixel data into the output frame. When the rectangle extends beyond the frame boundaries, the renderer writes past the allocated heap buffer. The existing clipping logic intended to centre oversized rectangles contained arithmetic that could fail for extreme coordinate values, leaving the rectangle unclamped. Additionally, the vertical rendering loop bound had an off-by-one error allowing one row past the last valid row.

The parser also lacked sufficient bounds validation when skipping over wipe command data, allowing reads beyond the input buffer. The rendering loop checked only one of the two interleaved stream offsets against the available data size, allowing the unchecked offset to advance past the data boundary and cause out-of-bounds reads.

Impact

A malicious third party could trigger a heap buffer overflow by providing a crafted DVD subpicture stream to an application using the dvdsubdec element, potentially resulting in a crash, denial of service, data corruption, or arbitrary code execution.

The dvdsubdec element has rank NONE and is not auto-plugged by playbin, decodebin, or the subtitleoverlay mechanism. An application must explicitly include dvdsubdec in its pipeline for this vulnerability to be triggered, limiting the attack surface compared to elements selected automatically.

Solution

The gst-plugins-ugly 1.28.6 release addresses the issue by clamping all rectangle coordinates to the output frame dimensions before rendering, validating wipe command length against available buffer data, and checking the correct stream offset in the rendering loop.

People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.6 release

• Release Notes
• GStreamer Plugins Ugly 1.28.6

Patches

• Patch