Security Advisory 2026-0028

Details

Use-after-free in the GStreamer core library when deserializing GstBuffer values. During buffer deserialization, error handling paths did not correctly order buffer unmapping and unreferencing operations. Specifically, on character validation failure the buffer was unreferenced before being unmapped, resulting in a use-after-free when gst_buffer_unmap() accessed the already-freed buffer.

Impact

A malicious third party could trigger a use-after-free by providing crafted data containing serialized buffer values with invalid content, potentially resulting in a crash, data corruption, or arbitrary code execution.

Solution

The GStreamer core 1.28.3 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer Core 1.28.3 release

• Release Notes
• GStreamer Core 1.28.3

Patches

• Patch