Security Advisory 2026-0092

Details

An out-of-bounds read vulnerability in the SVG image decoder in gst-plugins-bad. When the decoder finishes receiving input data for a frame, it scans the buffered data backwards for the SVG end tag. The scan is initialised to allow only a 6-byte tag comparison, but a second, 10-byte tag comparison is attempted without an additional bounds check, so it reads up to 4 bytes beyond the end of the buffered data for short SVG documents.

This affects all versions of gst-plugins-bad before 1.28.8.

Impact

A malicious third party could trigger an out-of-bounds read by providing a short crafted SVG file to the SVG image decoder. This can result in an application crash, denial of service, or information disclosure through leaked heap memory.

Solution

The gst-plugins-bad 1.28.8 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.8 release

• Release Notes
• GStreamer Plugins Bad 1.28.8

Patches

• Patch