Security Advisory 2026-0098 (CVE-2026-XXXX pending)
| Summary | Out-of-bounds write and infinite loop when reading responses from a Festival speech synthesis server |
| Date | 2026-11-06 |
| Affected Versions | GStreamer gst-plugins-bad < 1.28.9 |
| IDs | GStreamer-SA-2026-0098 CVE-2026-XXXX (pending) |
Details
The Festival text-to-speech plugin in gst-plugins-bad communicates with a Festival speech synthesis server over a network connection. Responses from the server are read without checking for read errors or a premature close of the connection. A malicious or broken server that closes the connection before a complete response has been received, or that causes read errors while data is still expected, can make the plugin write data outside of the bounds of an internal stack buffer, or get stuck in an endless loop that consumes CPU indefinitely.
The vulnerability requires an application to explicitly use the plugin, which is never set up automatically by GStreamer, and by default the plugin only connects to a speech synthesis server on the local machine.
Impact
An attacker who controls the speech synthesis server that an application connects to can crash or hang the application, resulting in a denial of service. The out-of-bounds writes may in some circumstances also lead to memory corruption. The attack surface is limited as the plugin is not automatically used and connects to a local server by default.
Solution
The gst-plugins-bad 1.28.9 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.