Quick answers
- Is CVE-2026-121259 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-121259 being exploited in the wild.
- How severe is CVE-2026-121259?
- Medium severity, with a CVSS score of 6.5, published 3 November 2026.
- Which products and versions are affected?
- GStreamer gst-plugins-bad.
- Is there a fix for CVE-2026-121259?
- Yes: fixed in GStreamer 1.28 and later. Until then: Applications that do not require JPEG 2000 decimation can avoid using the jp2kdecimator element and reject untrusted JPEG 2000 media before it reaches the processing pipeline. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-121259 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-121259?
- Check whether you run Gstreamer Gst-Plugins-Bad. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: GStreamer 1.28 and later
Applications that do not require JPEG 2000 decimation can avoid using the jp2kdecimator element and reject untrusted JPEG 2000 media before it reaches the processing pipeline.
Technical details
The vulnerability involves integer overflows and division by zero errors in the JPEG 2000 decimator (jp2kdecimator element) during tile processing. An attacker can craft malicious JPEG 2000 media that triggers these arithmetic errors, causing the application to crash. Exploitation requires the target application to process attacker-controlled JPEG 2000 media through a vulnerable pipeline; no authentication or elevated privileges are needed.
Affected products
- GStreamer gst-plugins-bad
Timeline
- 2026-11-03: disclosed