GST-PLUGINS-BASE · CVE-2026-125040 · Runtime
NO FIX YET
The SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base uses unanchored regular expressions while sanitizing inline markup, so a long line of unmatched markup-like text makes CPU use grow quadratically. An attacker who supplies a crafted subtitle cue can make a GStreamer-based application unresponsive.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any application built on GStreamer that parses SRT or WebVTT subtitles from untrusted input, such as media players, transcoders or upload pipelines, can be made unresponsive by a crafted cue. Systems that never load subtitle files from outside sources are unlikely to be exposed. The sources do not name the fixed version.
Not affected if no-untrusted-subtitles, subtitle-parsing-unused
Who cares gst-plugins-base, gstreamer, media-processing, self-hosted
Unknown from the sources.
No fix yet, per the sources.
A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle markup, the parser repeatedly searches the remaining text with unanchored regular expressions. A crafted subtitle cue with a long line of unmatched markup-like text can force quadratic CPU use and make a GStreamer-based application unresponsive.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.