{"id":"CVE-2026-125040","kind":"vulnerability","aliases":["CVE-2026-125040"],"related":[],"title":"GStreamer: crafted subtitle cues can freeze media apps via CPU exhaustion","description":"A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle markup, the parser repeatedly searches the remaining text with unanchored regular expressions. A crafted subtitle cue with a long line of unmatched markup-like text can force quadratic CPU use and make a GStreamer-based application unresponsive.","summary":"The SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base uses unanchored regular expressions while sanitizing inline markup, so a long line of unmatched markup-like text makes CPU use grow quadratically. An attacker who supplies a crafted subtitle cue can make a GStreamer-based application unresponsive.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"gst-plugins-base","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["gst-plugins-base","gstreamer","media-processing","runtime","self-hosted"],"not_affected_if":["no-untrusted-subtitles","subtitle-parsing-unused"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-09T19:16:48+00:00","first_seen_at":"2026-11-09T19:28:14+00:00","triaged_at":"2026-11-09T19:31:52+00:00","updated_at":"2026-11-09T19:31:52+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-09T19:31:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"GStreamer: crafted subtitle cues can freeze media apps via CPU exhaustion","impact":"low","summary":"The SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base uses unanchored regular expressions while sanitizing inline markup, so a long line of unmatched markup-like text makes CPU use grow quadratically. An attacker who supplies a crafted subtitle cue can make a GStreamer-based application unresponsive.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["gstreamer","gst-plugins-base","media-processing","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"application becomes unresponsive from CPU exhaustion","analyst_note":"Find the fixed gst-plugins-base version and the upstream commit at https://nvd.nist.gov/vuln/detail/CVE-2026-125040 to fill fix and how_to_check.","how_to_check":"- Check whether the application uses GStreamer's subtitle parsing, for example with `gst-inspect-1.0 subparse` or by confirming the `gst-plugins-base` package on the host.\n- Look up the installed `gst-plugins-base` version with `pkg-config --modversion gstreamer-base-1.0` and compare it to the fixed version in the NVD entry.","plain_action":"","product_name":"gst-plugins-base","needs_analyst":true,"not_affected_if":["no-untrusted-subtitles","subtitle-parsing-unused"],"who_is_affected":"Any application built on GStreamer that parses SRT or WebVTT subtitles from untrusted input, such as media players, transcoders or upload pipelines, can be made unresponsive by a crafted cue. Systems that never load subtitle files from outside sources are unlikely to be exposed. The sources do not name the fixed version.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000821,"input_tokens":4585,"output_tokens":725,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125040':14A,17A '-2026':13A,16A 'app':8A 'applic':84B,145C 'attack':71B 'base':21A,25B,46B,83B,103C,144C 'cpu':10A,66B,137C 'craft':2A,75B,121C 'cue':4A,77B,123C 'cve':12A,15A 'exhaust':11A 'express':50B,119C 'flaw':87C 'forc':135C 'found':89C 'freez':6A 'grow':68B 'gst':19A,23B,44B,101C 'gst-plugins-bas':22B,43B,100C 'gst-plugins-base':18A 'gstreamer':1A,26B,41B,82B,98C,143C 'gstreamer-bas':81B,142C 'host':33B 'inlin':53B,106C 'like':63B,132C 'line':58B,127C 'long':57B,126C 'make':65B,79B,140C 'markup':54B,62B,108C,131C 'markup-lik':61B,130C 'media':7A,28B 'media-process':27B 'parser':39B,96C,110C 'plugin':24B,45B,102C 'plugins':20A 'process':29B 'quadrat':69B,136C 'regular':49B,118C 'remain':114C 'repeat':111C 'runtim':30B 'sanit':52B,105C 'search':112C 'self':32B 'self-host':31B 'srt':35B,92C 'subtitl':3A,38B,76B,95C,107C,122C 'suppli':73B 'text':64B,115C,133C 'unanchor':48B,117C 'unmatch':60B,129C 'unrespons':85B,146C 'use':47B,67B,138C 'via':9A 'webvtt':37B,94C","nicknames":[],"mitigations":[],"who_affected":"Any application built on GStreamer that parses SRT or WebVTT subtitles from untrusted input, such as media players, transcoders or upload pipelines, can be made unresponsive by a crafted cue. Systems that never load subtitle files from outside sources are unlikely to be exposed. The sources do not name the fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["gstpluginsbase"],"ptokens":["base","gst","plugins"],"labels":["gstpluginsbase","gstreamer","mediaprocessing","medium","runtime","selfhosted","vendor"],"campaign_type":null,"search_a":"'-125040':14A,17A '-2026':13A,16A 'app':8A 'base':21A 'cpu':10A 'craft':2A 'cue':4A 'cve':12A,15A 'exhaust':11A 'freez':6A 'gst':19A 'gst-plugins-base':18A 'gstreamer':1A 'media':7A 'plugins':20A 'subtitl':3A 'via':9A","search_b":"'applic':84B 'attack':71B 'base':25B,46B,83B 'cpu':66B 'craft':75B 'cue':77B 'express':50B 'grow':68B 'gst':23B,44B 'gst-plugins-bas':22B,43B 'gstreamer':26B,41B,82B 'gstreamer-bas':81B 'host':33B 'inlin':53B 'like':63B 'line':58B 'long':57B 'make':65B,79B 'markup':54B,62B 'markup-lik':61B 'media':28B 'media-process':27B 'parser':39B 'plugin':24B,45B 'process':29B 'quadrat':69B 'regular':49B 'runtim':30B 'sanit':52B 'self':32B 'self-host':31B 'srt':35B 'subtitl':38B,76B 'suppli':73B 'text':64B 'unanchor':48B 'unmatch':60B 'unrespons':85B 'use':47B,67B 'webvtt':37B","search_c":"'applic':145C 'base':103C,144C 'cpu':137C 'craft':121C 'cue':123C 'express':119C 'flaw':87C 'forc':135C 'found':89C 'gst':101C 'gst-plugins-bas':100C 'gstreamer':98C,143C 'gstreamer-bas':142C 'inlin':106C 'like':132C 'line':127C 'long':126C 'make':140C 'markup':108C,131C 'markup-lik':130C 'parser':96C,110C 'plugin':102C 'quadrat':136C 'regular':118C 'remain':114C 'repeat':111C 'sanit':105C 'search':112C 'srt':92C 'subtitl':95C,107C,122C 'text':115C,133C 'unanchor':117C 'unmatch':129C 'unrespons':146C 'use':138C 'webvtt':94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125040","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125040","severity":null,"published_at":"2026-11-09T19:16:48+00:00","modified_at":"2026-11-09T19:16:48+00:00","first_seen_at":"2026-11-09T19:28:14+00:00","fetched_at":"2026-11-09T19:28:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}