Executive brief
GStreamer is a widely used multimedia framework that handles video and audio playback on Linux and other platforms. A flaw in its JPEG image processing component allows a specially crafted image file to crash applications or potentially expose sensitive memory information. This could be exploited if a user is tricked into opening a malicious file or visiting a website that loads such an image.
Technical details
An out-of-bounds read vulnerability exists in the VA JPEG decoder within GStreamer's gst-plugins-bad. The root cause is located in the gst_jpeg_parse() function in gstjpegparser.c, which reads a segment length value from the JPEG bitstream without validating it against the actual available data in the buffer. The VA JPEG decoder subsequently trusts this unvalidated size value to construct a byte reader, leading to reads beyond the input buffer. This is a network-reachable vulnerability requiring user interaction (opening a file). It can result in an application crash (DoS) or potential information disclosure. A fix is planned for GStreamer versions 1.28.4/1.28.5.
Affected products
- GStreamer gst-plugins-bad Prior to 1.28.4
Timeline
- 2026-06-02: other: Upstream maintainer confirmed the vulnerability
- 2026-06-08: other: Initial bug report created in Red Hat Bugzilla
- 2026-06-15: advisory: CVE published by NVD and Red Hat