Executive brief
GStreamer, a widely used framework for handling multimedia files, contains a flaw in its PCAP parsing component often used for network debugging. An attacker could provide a specially crafted network capture file that, when processed, causes the application to crash or potentially leak small amounts of memory information. Because this component is typically used only during technical debugging, the risk to standard production operations is considered low.
Technical details
Multiple out-of-bounds (OOB) read vulnerabilities exist in the 'pcapparse' element within GStreamer's 'gst-plugins-bad' package. The root cause is insufficient validation of buffer boundaries during IPv4 and TCP/UDP header parsing in gstpcapparse.c. Specifically, the code reads port information without verifying buffer length and trusts the 'ip_packet_len' field to calculate payload sizes, which can lead to reads exceeding the current buffer. Exploitation requires a user to process a malicious PCAP file through a GStreamer pipeline that includes the pcapparse element. A fix is planned for GStreamer version 1.28.4.
Affected products
- GStreamer GStreamer versions prior to 1.28.4
Timeline
- 2026-06-02: other: Upstream maintainer confirmed the vulnerability
- 2026-06-09: disclosed: Initial bug report created
- 2026-06-15: advisory: NVD and Red Hat published advisory details