Executive brief
A denial of service vulnerability exists in GStreamer, a widely used multimedia framework for handling audio and video. By tricking a user into opening a specially crafted AV1 video file, an attacker can cause the application using GStreamer to crash. This impact disrupts service availability and can lead to application instability for users processing untrusted media content.
Technical details
A Reachable Assertion (CWE-617) vulnerability exists in the GStreamer AV1 codec parser within the 'gst-plugins-bad' package. The root cause is located in the gst_av1_parser_parse_tile_list_obu() function in gstav1parser.c, which incorrectly passes a byte count to the gst_bit_reader_skip() API when a bit count is expected. This leads to parser desynchronization and a deterministic g_assert abort. An attacker can exploit this by providing a malformed AV1 media file (as small as 21 bytes) to be processed by the library. A fix is planned for GStreamer versions 1.28.4 or 1.28.5.
Affected products
- GStreamer GStreamer gst-plugins-bad Versions prior to 1.28.4/1.28.5
Timeline
- 2026-06-02: other: Upstream confirmed by maintainer
- 2026-06-08: other: Reported to Red Hat Bugzilla
- 2026-06-15: disclosed: NVD publication date