# CVE-2026-121259: GStreamer gst-plugins-bad JPEG 2000 decimator integer overflow and division by zero

Source: https://junglewise.ai/threats/cve-2026-121259-a-flaw-was-found-in-the-gstreamer-jpeg-2000-decimator-in-gst  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-121259 · Severity: medium · CVSS 6.5 · Published 2026-11-03

GStreamer is a multimedia framework used by applications to process audio and video content. A flaw in its JPEG 2000 decimator component can crash applications that process specially crafted JPEG 2000 media, causing a denial of service. An attacker can exploit this by delivering malicious media files to applications that use this functionality.

Technologies: [Gstreamer Gst-Plugins-Bad](https://junglewise.ai/threats/technologies/gst-plugins-bad). Vendors: [Gstreamer](https://junglewise.ai/threats/vendors/gstreamer).

## Quick answers

**Is CVE-2026-121259 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121259 being exploited in the wild.

**How severe is CVE-2026-121259?** Medium severity, with a CVSS score of 6.5, published 3 November 2026.

**Which products and versions are affected?** GStreamer gst-plugins-bad.

**Is there a fix for CVE-2026-121259?** Yes: fixed in GStreamer 1.28 and later. Until then: Applications that do not require JPEG 2000 decimation can avoid using the jp2kdecimator element and reject untrusted JPEG 2000 media before it reaches the processing pipeline. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121259 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-121259?** Check whether you run Gstreamer Gst-Plugins-Bad. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in GStreamer 1.28 and later

Applications that do not require JPEG 2000 decimation can avoid using the jp2kdecimator element and reject untrusted JPEG 2000 media before it reaches the processing pipeline.

## Technical details

The vulnerability involves integer overflows and division by zero errors in the JPEG 2000 decimator (jp2kdecimator element) during tile processing. An attacker can craft malicious JPEG 2000 media that triggers these arithmetic errors, causing the application to crash. Exploitation requires the target application to process attacker-controlled JPEG 2000 media through a vulnerable pipeline; no authentication or elevated privileges are needed.

## Affected products

- GStreamer gst-plugins-bad

## Timeline

- 2026-11-03: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-121259](https://access.redhat.com/security/cve/CVE-2026-121259)

## Related threats

- [GStreamer gst-plugins-bad out-of-bounds read in MPEG/DVD parsing](https://junglewise.ai/threats/cve-2026-125706-a-flaw-was-found-in-gstreamer-s-gst-plugins-bad-mpeg-program)
- [GStreamer gst-plugins-bad MXF plugin buffer overflow in VANC handling](https://junglewise.ai/threats/cve-2026-125703-a-flaw-was-found-in-the-gstreamer-gst-plugins-bad-mxf-plugin)
- [GStreamer gst-plugins-bad H.265 uninitialized memory use](https://junglewise.ai/threats/cve-2026-121611-a-flaw-was-found-in-gstreamer-s-gst-plugins-bad-package-a-use-of)
- [GStreamer MXF demuxer out-of-bounds read](https://junglewise.ai/threats/cve-2026-121601-a-flaw-was-found-in-gstreamer-s-mxf-demuxer-plugin-gst-plugins)
- [GStreamer gst-plugins-bad NULL pointer dereference in H.264 MVC parser](https://junglewise.ai/threats/cve-2026-119728-a-flaw-was-found-in-the-h-264-video-parser-in-gst-plugins-bad)