# CVE-2026-52718: GStreamer gst-plugins-bad denial of service in AV1 codec parser

Source: https://junglewise.ai/threats/cve-2026-52718-gstreamer-gst-plugins-bad-denial-of-service-in-av1-codec-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-52718 · Severity: medium · CVSS 6.5 · Published 2026-06-15

A denial of service vulnerability exists in GStreamer, a widely used multimedia framework for handling audio and video. By tricking a user into opening a specially crafted AV1 video file, an attacker can cause the application using GStreamer to crash. This impact disrupts service availability and can lead to application instability for users processing untrusted media content.

Technologies: [Gstreamer Gst-Plugins-Bad](https://junglewise.ai/threats/technologies/gst-plugins-bad). Vendors: [Gstreamer](https://junglewise.ai/threats/vendors/gstreamer).

## Quick answers

**Is CVE-2026-52718 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52718 being exploited in the wild.

**How severe is CVE-2026-52718?** Medium severity, with a CVSS score of 6.5, published 15 June 2026.

**Which products and versions are affected?** Gstreamer Gst-Plugins-Bad Versions prior to 1.28.4/1.28.5.

**Is there a fix for CVE-2026-52718?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-52718 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-52718?** Check whether you run Gstreamer Gst-Plugins-Bad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Reachable Assertion (CWE-617) vulnerability exists in the GStreamer AV1 codec parser within the 'gst-plugins-bad' package. The root cause is located in the gst_av1_parser_parse_tile_list_obu() function in gstav1parser.c, which incorrectly passes a byte count to the gst_bit_reader_skip() API when a bit count is expected. This leads to parser desynchronization and a deterministic g_assert abort. An attacker can exploit this by providing a malformed AV1 media file (as small as 21 bytes) to be processed by the library. A fix is planned for GStreamer versions 1.28.4 or 1.28.5.

## Affected products

- GStreamer GStreamer gst-plugins-bad Versions prior to 1.28.4/1.28.5

## Timeline

- 2026-06-02: other: Upstream confirmed by maintainer
- 2026-06-08: other: Reported to Red Hat Bugzilla
- 2026-06-15: disclosed: NVD publication date

## References

- [https://access.redhat.com/security/cve/CVE-2026-52718](https://access.redhat.com/security/cve/CVE-2026-52718)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2486328](https://bugzilla.redhat.com/show_bug.cgi?id=2486328)
- [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5103](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5103)

## Related threats

- [GStreamer gst-plugins-bad out-of-bounds read in MPEG/DVD parsing](https://junglewise.ai/threats/cve-2026-125706-a-flaw-was-found-in-gstreamer-s-gst-plugins-bad-mpeg-program)
- [GStreamer gst-plugins-bad MXF plugin buffer overflow in VANC handling](https://junglewise.ai/threats/cve-2026-125703-a-flaw-was-found-in-the-gstreamer-gst-plugins-bad-mxf-plugin)
- [GStreamer gst-plugins-bad H.265 uninitialized memory use](https://junglewise.ai/threats/cve-2026-121611-a-flaw-was-found-in-gstreamer-s-gst-plugins-bad-package-a-use-of)
- [GStreamer MXF demuxer out-of-bounds read](https://junglewise.ai/threats/cve-2026-121601-a-flaw-was-found-in-gstreamer-s-mxf-demuxer-plugin-gst-plugins)
- [GStreamer gst-plugins-bad JPEG 2000 decimator integer overflow and division by zero](https://junglewise.ai/threats/cve-2026-121259-a-flaw-was-found-in-the-gstreamer-jpeg-2000-decimator-in-gst)