Security Advisory 2026-0003 (ZDI-CAN-28840, CVE-2026-3082)

Details

Heap-based Buffer Overflow when parsing Huffman tables in JPEG files, at copying the data to a storage variable.

Impact

It might be possible for a malicious third party to trigger a crash in the application, and possibly also effect code execution through heap manipulation.

Threat mitigation

The code now does bound checking with the storage variables.

The gst-plugins-bad 1.28.1 release address the issue. People using older branches of GStreamer should apply the patch and recompile.

Workarounds

The user should refrain from opening files from untrusted third parties or accessing untrusted remote sites, or not use VA JPEG decoder and encoder, or parse-jpeg example.

Solution

The gst-plugins-bad 1.28.1 release addresses the issue. People using older branches of GStreamer should apply the patch and recompile, or disable the VA plugin and remove the parse-jpep example.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• CVE-2026-3082

GStreamer 1.28.1 release

• Release Notes
• GStreamer Plugins Bad 1.28.1

Patches

• Patch