Security Advisory 2026-0020
|
|
| Summary |
Assertion failures in FLV demuxer on corrupted streams |
| Date |
2026-04-07 |
| Affected Versions |
GStreamer gst-plugins-good < 1.28.2 |
| IDs |
GStreamer-SA-2026-0020 |
Details
Assertion failures in the FLV demuxer when handling malformed or corrupted FLV
media files. The demuxer does not properly validate buffer sizes and data
availability before parsing audio and video tags, which can trigger assertions
when processing truncated or malicious FLV streams.
Impact
A malicious third party could trigger assertion failures that result in a crash
of the application when processing malicious FLV media files, leading to denial
of service.
Solution
The gst-plugins-good 1.28.2 release addresses the issue. People using older
versions of GStreamer should apply the patch and recompile.
References
The GStreamer project
CVE Database Entries
- No CVE number assigned or pending
GStreamer releases
1.28 (current stable)
Patches
