Security Advisory 2026-0081
| Summary | Out-of-bounds read and write in FFmpeg audio encoder and decoder with excessive channel counts |
| Date | 2026-09-07 |
| Affected Versions | GStreamer gst-libav < 1.28.7 |
| IDs | GStreamer-SA-2026-0081 |
Details
An out-of-bounds read and write vulnerability in the FFmpeg audio decoder and encoder elements in gst-libav. The channel layout mapping code used fixed-size 64-element arrays for audio channel positions but did not validate the channel count from decoded media against the array bounds. A crafted media file with more than 64 audio channels causes operations on these arrays to read and write beyond their allocated bounds.
This issue affects the FFmpeg-based audio decoder (avdec_) and audio encoder (avenc_) elements when processing media with an excessive audio channel count.
Impact
A malicious third party could trigger a process crash or denial of service by supplying a crafted media file with more than 64 audio channels. With a large channel count, heap corruption or stack corruption is possible, which could lead to data corruption or potentially arbitrary code execution.
Solution
The gst-libav 1.28.7 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.
References
The GStreamer project
CVE Database Entries
- No CVE number assigned or pending