Is CVE-2026-125040 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-125040 being exploited in the wild.

How severe is CVE-2026-125040?

Medium severity, with a CVSS score of 6.5, published 9 November 2026.

Which products and versions are affected?

Gstreamer Gst-Plugins-Base before 1.28.2.

How is CVE-2026-125040 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-125040?

Check whether you run Gstreamer Gst-Plugins-Base at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-125040: GStreamer gst-plugins-base quadratic regex in SRT/WebVTT parser

CVE-2026-125040 · Severity: medium · CVSS 6.5 · Published 2026-11-09

GStreamer is a multimedia framework used by many audio and video applications. A flaw in its subtitle parser allows an attacker to craft malicious SRT or WebVTT subtitle files that cause excessive CPU usage, making media player applications unresponsive or unusable. This affects any application using GStreamer to play video with untrusted subtitle tracks.

Technologies: Gstreamer Gst-Plugins-Base. Vendors: Gstreamer.

Quick answers

Is CVE-2026-125040 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-125040 being exploited in the wild.
How severe is CVE-2026-125040?: Medium severity, with a CVSS score of 6.5, published 9 November 2026.
Which products and versions are affected?: Gstreamer Gst-Plugins-Base before 1.28.2.
Is there a fix for CVE-2026-125040?: Yes: fixed in gst-plugins-base 1.28.2. Until then: Applications that do not require untrusted SRT/WebVTT subtitles can prevent automatic selection of the subparse element by setting GST_PLUGIN_FEATURE_RANK=subparse:NONE. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-125040 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-125040?: Check whether you run Gstreamer Gst-Plugins-Base at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: gst-plugins-base 1.28.2

Applications that do not require untrusted SRT/WebVTT subtitles can prevent automatic selection of the subparse element by setting GST_PLUGIN_FEATURE_RANK=subparse:NONE.

Technical details

The SRT and WebVTT subtitle parser in gst-plugins-base's subrip_fix_up_markup() function uses unanchored regular expressions that perform quadratic backtracking when processing crafted markup-like text. A remote attacker can deliver a malicious subtitle track via network media stream or local file, causing the subparse element to enter a resource-exhaustion state. The flaw exists in gst-plugins-base versions before 1.28.2.

Affected products

GStreamer gst-plugins-base before 1.28.2

Timeline

2026-11-09: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.