Quick answers
- Is CVE-2026-125706 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-125706 being exploited in the wild.
- How severe is CVE-2026-125706?
- Medium severity, with a CVSS score of 5.5, published 10 November 2026.
- Which products and versions are affected?
- Gstreamer Gst-Plugins-Bad <UNKNOWN>.
- Is there a fix for CVE-2026-125706?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-125706 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-125706?
- Check whether you run Gstreamer Gst-Plugins-Bad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The PES (Packetized Elementary Stream) header parsers in gst-plugins-bad fail to validate remaining data before reading timestamps and optional fields, leading to an out-of-bounds read when processing crafted MPEG Program Stream or DVD files. An unauthenticated attacker can trigger this by providing a specially crafted media file, causing the application to crash on playback without requiring user interaction beyond opening the file.
Affected products
- GStreamer gst-plugins-bad <UNKNOWN>
Timeline
- 2026-11-10: disclosed