{"id":"CVE-2026-121259","kind":"vulnerability","aliases":["CVE-2026-121259"],"related":[],"title":"GStreamer: crafted JPEG 2000 media can crash apps processing it","description":"A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad. Crafted JPEG 2000 media can cause integer overflows or division by zero during tile processing. An application that processes the malicious media may crash, resulting in a denial of service.","summary":"The JPEG 2000 decimator in GStreamer's gst-plugins-bad plugin mishandles tile processing, causing integer overflows or division by zero. An attacker who supplies crafted JPEG 2000 media can crash any application that processes it, a denial of service.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gst-plugins-bad","gstreamer","jpeg2000","media-processing","package"],"not_affected_if":["no-jpeg2000-decoding","no-untrusted-media"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-03T17:18:07+00:00","first_seen_at":"2026-11-03T17:21:56+00:00","triaged_at":"2026-11-03T17:24:08+00:00","updated_at":"2026-11-03T17:24:08+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T17:24:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"GStreamer: crafted JPEG 2000 media can crash apps processing it","impact":"low","summary":"The JPEG 2000 decimator in GStreamer's gst-plugins-bad plugin mishandles tile processing, causing integer overflows or division by zero. An attacker who supplies crafted JPEG 2000 media can crash any application that processes it, a denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["gstreamer","gst-plugins-bad","jpeg2000","media-processing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Application crashes, denying service while processing malicious media","analyst_note":"Confirm affected gst-plugins-bad versions and the fixed release from the NVD entry and the upstream GStreamer advisory.","how_to_check":"- Check whether the `gst-plugins-bad` package is installed and its version, for example with `gst-inspect-1.0 jpeg2000` or your distribution's package manager.\n- Look for applications that decode JPEG 2000 images through GStreamer.","plain_action":"","needs_analyst":true,"not_affected_if":["no-jpeg2000-decoding","no-untrusted-media"],"who_is_affected":"Applications that use GStreamer's JPEG 2000 decoding path on untrusted media, such as media processing services or desktop apps opening images from the internet. Systems that do not decode JPEG 2000 through GStreamer can skip it. The sources do not list affected versions.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000703,"input_tokens":4113,"output_tokens":584,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121259':12A,15A '-2026':11A,14A '2000':4A,28B,54B,75C,84C 'app':8A 'applic':59B,98C 'attack':49B 'bad':19B,36B,81C 'caus':41B,87C 'craft':2A,52B,82C 'crash':7A,57B,105C 'cve':10A,13A 'decim':29B,76C 'denial':64B,109C 'divis':45B,91C 'flaw':68C 'found':70C 'gst':17B,34B,79C 'gst-plugins-bad':16B,33B,78C 'gstreamer':1A,20B,31B,73C 'integ':42B,88C 'jpeg':3A,27B,53B,74C,83C 'jpeg2000':21B 'malici':102C 'may':104C 'media':5A,23B,55B,85C,103C 'media-process':22B 'mishandl':38B 'overflow':43B,89C 'packag':25B 'plugin':18B,35B,37B,80C 'process':9A,24B,40B,61B,96C,100C 'result':106C 'servic':66B,111C 'suppli':51B 'tile':39B,95C 'zero':47B,93C","nicknames":[],"mitigations":[],"who_affected":"Applications that use GStreamer's JPEG 2000 decoding path on untrusted media, such as media processing services or desktop apps opening images from the internet. Systems that do not decode JPEG 2000 through GStreamer can skip it. The sources do not list affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gstpluginsbad","gstreamer","jpeg2000","mediaprocessing","medium","package"],"campaign_type":null,"first_public_at":"2026-11-03T17:18:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121259","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121259","severity":null,"published_at":"2026-11-03T17:18:07+00:00","modified_at":"2026-11-03T17:18:07+00:00","first_seen_at":"2026-11-03T17:21:56+00:00","fetched_at":"2026-11-03T17:21:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}