# CVE-2026-125704: GStreamer core buffer value deserialization use-after-free

Source: https://junglewise.ai/threats/cve-2026-125704-a-use-after-free-flaw-was-found-in-gstreamer-core-buffer-value  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-125704 · Severity: high · CVSS 7.5 · Published 2026-11-10

GStreamer is a multimedia framework that processes audio and video data, often used in media players and streaming applications. A use-after-free flaw in its buffer deserialization can cause an application to crash when processing specially crafted data. Network-facing GStreamer Data Protocol receivers are vulnerable without authentication or user interaction, while other applications are at risk only if they parse untrusted data.

Technologies: [Gstreamer](https://junglewise.ai/threats/technologies/gstreamer). Vendors: [Gstreamer](https://junglewise.ai/threats/vendors/gstreamer).

## Quick answers

**Is CVE-2026-125704 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-125704 being exploited in the wild.

**How severe is CVE-2026-125704?** High severity, with a CVSS score of 7.5, published 10 November 2026.

**Which products and versions are affected?** Gstreamer Before 1.28.2 (or equivalent fix version).

**Is there a fix for CVE-2026-125704?** No fixed version is recorded yet. Restrict access to network-facing GStreamer Data Protocol receivers to trusted peers. Avoid passing externally supplied strings to gst_caps_from_string() or gst_structure_from_string() until the vulnerability is patched.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-11-10"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-125704 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-125704?** Check whether you run Gstreamer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Restrict access to network-facing GStreamer Data Protocol receivers to trusted peers. Avoid passing externally supplied strings to gst_caps_from_string() or gst_structure_from_string() until the vulnerability is patched.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-11-10"}]

## Technical details

A use-after-free vulnerability exists in gst_value_deserialize_buffer() when processing crafted serialized buffer data with an invalid character; the error path frees a mapped buffer before unmapping it. The vulnerability is reachable via gdpdepay (GStreamer Data Protocol depayloader) which passes unvalidated CAPS payloads to gst_caps_from_string() without authentication or user interaction. Exploitation causes denial of service through process termination; code execution has not been demonstrated.

## Affected products

- GStreamer GStreamer Before 1.28.2 (or equivalent fix version)

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-125704](https://access.redhat.com/security/cve/CVE-2026-125704)

## Related threats

- [GStreamer MXF demuxer off-by-one buffer write](https://junglewise.ai/threats/cve-2026-125707-a-flaw-was-found-in-gstreamer-s-mxf-demuxer-when-an-application)
- [GStreamer integer overflow in AV1 LEB128 parser](https://junglewise.ai/threats/cve-2026-119729-a-flaw-was-found-in-gstreamer-an-integer-overflow-vulnerability)
- [GStreamer rtpL16depay heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-111183-gstreamer-rtpl16depay-heap-based-buffer-overflow-remote-code)
- [GStreamer rtpsbcdepay use-after-free in RTP SBC payload parsing](https://junglewise.ai/threats/cve-2026-18299-gstreamer-rtpsbcdepay-use-after-free-in-rtp-sbc-payload-parsing)
- [GStreamer gst-plugins-good heap buffer overflow in GdkPixbuf decoder](https://junglewise.ai/threats/cve-2026-18298-gstreamer-gst-plugins-good-heap-buffer-overflow-in-gdkpixbuf)