Is CVE-2026-125704 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-125704 being exploited in the wild.

How severe is CVE-2026-125704?

High severity, with a CVSS score of 7.5, published 10 November 2026.

Which products and versions are affected?

Gstreamer Before 1.28.2 (or equivalent fix version).

How is CVE-2026-125704 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-125704?

Check whether you run Gstreamer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-125704: GStreamer core buffer value deserialization use-after-free

CVE-2026-125704 · Severity: high · CVSS 7.5 · Published 2026-11-10

GStreamer is a multimedia framework that processes audio and video data, often used in media players and streaming applications. A use-after-free flaw in its buffer deserialization can cause an application to crash when processing specially crafted data. Network-facing GStreamer Data Protocol receivers are vulnerable without authentication or user interaction, while other applications are at risk only if they parse untrusted data.

Technologies: Gstreamer. Vendors: Gstreamer.

Quick answers

Is CVE-2026-125704 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-125704 being exploited in the wild.
How severe is CVE-2026-125704?: High severity, with a CVSS score of 7.5, published 10 November 2026.
Which products and versions are affected?: Gstreamer Before 1.28.2 (or equivalent fix version).
Is there a fix for CVE-2026-125704?: No fixed version is recorded yet. Restrict access to network-facing GStreamer Data Protocol receivers to trusted peers. Avoid passing externally supplied strings to gst_caps_from_string() or gst_structure_from_string() until the vulnerability is patched.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-11-10"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-125704 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-125704?: Check whether you run Gstreamer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Restrict access to network-facing GStreamer Data Protocol receivers to trusted peers. Avoid passing externally supplied strings to gst_caps_from_string() or gst_structure_from_string() until the vulnerability is patched.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-11-10"}]

Technical details

A use-after-free vulnerability exists in gst_value_deserialize_buffer() when processing crafted serialized buffer data with an invalid character; the error path frees a mapped buffer before unmapping it. The vulnerability is reachable via gdpdepay (GStreamer Data Protocol depayloader) which passes unvalidated CAPS payloads to gst_caps_from_string() without authentication or user interaction. Exploitation causes denial of service through process termination; code execution has not been demonstrated.

Affected products

GStreamer GStreamer Before 1.28.2 (or equivalent fix version)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.