Security Advisory 2026-0085
| Summary | Stack-based out-of-bounds write in closed caption converter and combiner |
| Date | 2026-10-08 |
| Affected Versions | GStreamer gst-plugins-bad < 1.28.8 |
| IDs | GStreamer-SA-2026-0085 |
Details
The closed caption converter and combiner elements in gst-plugins-bad copy incoming closed caption data into fixed-size internal buffers without validating the data length. Crafted CEA708 closed caption data longer than the maximum expected size causes a stack-based out-of-bounds write when converted by ccconverter or combined by cccombiner. Additionally, when cccombiner processes CEA608 closed caption data in SMPTE S334-1A format, it appends the input data to fixed-size internal buffers per field without validating the length, and crafted input longer than the maximum expected size causes a stack-based out-of-bounds write.
Impact
A malicious third party could trigger a stack-based out-of-bounds write by providing crafted media data containing oversized CEA708 or CEA608 (S334-1A format) closed caption data, potentially resulting in a crash, denial of service, or arbitrary code execution.
Solution
The gst-plugins-bad 1.28.8 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.
References
The GStreamer project
CVE Database Entries
- No CVE number assigned or pending