Security Advisory 2026-0099 (CVE-2026-XXXX)
| Summary | Out-of-bounds read when parsing DVB short event descriptors |
| Date | 2026-11-06 |
| Affected Versions | GStreamer gst-plugins-bad < 1.28.9 |
| IDs | GStreamer-SA-2026-0099 CVE-2026-XXXX |
Details
The helper library for MPEG-TS streams in gst-plugins-bad contains an out-of-bounds read vulnerability when parsing DVB short event descriptors. Descriptor fields with attacker-controlled lengths were read without validating them against the size of the descriptor, so a truncated descriptor at the end of a section could make the parser read past the end of the allocated buffer.
This update also fixes further issues of a similar class in the related section, descriptor and scheduling parsers of the same library, including out-of-bounds reads, a use-after-free and missing input validation.
Impact
A malicious third party can trigger an out-of-bounds read by providing a specially crafted MPEG-TS stream or broadcast, which can result in a crash and denial of service of the application, and may in some circumstances leak contents of adjacent heap memory.
Solution
The gst-plugins-bad 1.28.9 release addresses the issues. People using older versions of GStreamer should apply the patch and recompile.