Live › vulnerability › CVE-2026-121259
The JPEG 2000 decimator in GStreamer's gst-plugins-bad plugin mishandles tile processing, causing integer overflows or division by zero. An attacker who supplies crafted JPEG 2000 media can crash any application that processes it, a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:21 UTC. All times on this page are UTC.
Applications that use GStreamer's JPEG 2000 decoding path on untrusted media, such as media processing services or desktop apps opening images from the internet. Systems that do not decode JPEG 2000 through GStreamer can skip it. The sources do not list affected versions.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad. Crafted JPEG 2000 media can cause integer overflows or division by zero during tile processing. An application that processes the malicious media may crash, resulting in a denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-121259")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.