Security Advisory 2026-0078

Details

A type confusion vulnerability in the GValue comparison logic of GStreamer core. When comparing lists containing elements of mixed types, the wrong comparison function was applied to incompatible value types, causing a segmentation fault.

The vulnerability is triggered during caps parsing. Elements such as rtpgstdepay parse incoming caps from network streams, making this exploitable e.g. through crafted RTSP streams.

Impact

A malicious third party could trigger a remote denial of service by providing caps with mixed-type value lists, e.g. through crafted RTSP streams. This results in an immediate application crash.

Solution

The GStreamer core 1.28.8 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.8 release

• Release Notes
• GStreamer Core 1.28.8

Patches

• Patch