Is CVE-2026-52718 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52718 being exploited in the wild.

How severe is CVE-2026-52718?

Medium severity, with a CVSS score of 6.5, published 15 June 2026.

Which products and versions are affected?

Gstreamer Gst-Plugins-Bad Versions prior to 1.28.4/1.28.5.

Is there a fix for CVE-2026-52718?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-52718 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-52718?

Check whether you run Gstreamer Gst-Plugins-Bad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52718: GStreamer gst-plugins-bad denial of service in AV1 codec parser

CVE-2026-52718 · Severity: medium · CVSS 6.5 · Published 2026-06-15

A denial of service vulnerability exists in GStreamer, a widely used multimedia framework for handling audio and video. By tricking a user into opening a specially crafted AV1 video file, an attacker can cause the application using GStreamer to crash. This impact disrupts service availability and can lead to application instability for users processing untrusted media content.

Technologies: Gstreamer Gst-Plugins-Bad. Vendors: Gstreamer.

Quick answers

Is CVE-2026-52718 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52718 being exploited in the wild.
How severe is CVE-2026-52718?: Medium severity, with a CVSS score of 6.5, published 15 June 2026.
Which products and versions are affected?: Gstreamer Gst-Plugins-Bad Versions prior to 1.28.4/1.28.5.
Is there a fix for CVE-2026-52718?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-52718 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-52718?: Check whether you run Gstreamer Gst-Plugins-Bad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Reachable Assertion (CWE-617) vulnerability exists in the GStreamer AV1 codec parser within the 'gst-plugins-bad' package. The root cause is located in the gst_av1_parser_parse_tile_list_obu() function in gstav1parser.c, which incorrectly passes a byte count to the gst_bit_reader_skip() API when a bit count is expected. This leads to parser desynchronization and a deterministic g_assert abort. An attacker can exploit this by providing a malformed AV1 media file (as small as 21 bytes) to be processed by the library. A fix is planned for GStreamer versions 1.28.4 or 1.28.5.

Affected products

GStreamer GStreamer gst-plugins-bad Versions prior to 1.28.4/1.28.5

Timeline

2026-06-02: other: Upstream confirmed by maintainer
2026-06-08: other: Reported to Red Hat Bugzilla
2026-06-15: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.