Security Advisory 2026-0024

Details

Multiple out-of-bounds read vulnerabilities in the MPEG PES (Packetized Elementary Stream) header parser in gst-plugins-bad. The vulnerabilities exist in both the mpegdemux element and the resindvd PES filter when parsing MPEG Program Stream (PS) files.

The issues occur when parsing malformed MPEG Program Stream files:

1. Missing bounds checks before reading DTS/PTS timestamps in PES headers, allowing reads beyond buffer boundaries
2. Insufficient validation when scanning for timestamps in program streams, including potential integer overflows in length calculations
3. Missing bounds checks when parsing PES extension fields, including pack header fields and extension field lengths that could exceed available data

Impact

A malicious third party could trigger out-of-bounds reads when processing malicious MPEG Program Stream files, resulting in application crashes and denial of service. Information disclosure is also possible as sensitive memory contents could be exposed.

Solution

The gst-plugins-bad 1.28.3 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.3 release

• Release Notes
• GStreamer Plugins Bad 1.28.3

Patches

• Patch