{"id":"CVE-2026-125704","kind":"vulnerability","aliases":["CVE-2026-125704"],"related":[],"title":"GStreamer: crafted buffer data triggers use-after-free, possible crash","description":"A use-after-free flaw was found in GStreamer core buffer value deserialization. When crafted serialized buffer data contains an invalid character, an error path frees a mapped buffer before unmapping it. An application that parses untrusted caps or structure data could crash; a network-facing GStreamer Data Protocol receiver can process such data without user interaction. Further impact has not been established.","summary":"GStreamer's core buffer value deserialization frees a mapped buffer before unmapping it when serialized data contains an invalid character. An application parsing untrusted caps or structure data can crash, and a network-facing GStreamer Data Protocol receiver can be triggered without user interaction.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"gstreamer","fixed":["1.28.3"],"affected":"< 1.28.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["gstreamer","media-pipelines","network-receivers","runtime"],"not_affected_if":["local-media-only","no-untrusted-input"],"how_to_check":"Run 'gst-launch-1.0 --version' or 'gst-inspect-1.0 --version' (or pkg-config --modversion gstreamer-1.0); GStreamer core below 1.28.3 is affected. Also check distro packages (gstreamer1 / libgstreamer1.0) and bundled copies in apps for their backported fix status.","fix":"Upgrade GStreamer core to 1.28.3 or later (1.28.9 is the current 1.28 stable); older versions: apply the upstream patch and recompile.","status":"open","published_at":"2026-11-10T11:16:43+00:00","first_seen_at":"2026-11-10T11:21:35+00:00","triaged_at":"2026-11-10T11:22:01+00:00","updated_at":"2026-11-10T11:22:40+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-10T11:22:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"GStreamer: crafted buffer data triggers use-after-free, possible crash","impact":"medium","summary":"GStreamer's core buffer value deserialization frees a mapped buffer before unmapping it when serialized data contains an invalid character. An application parsing untrusted caps or structure data can crash, and a network-facing GStreamer Data Protocol receiver can be triggered without user interaction.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["gstreamer","media-pipelines","network-receivers"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Application crashes; further code execution impact not established","analyst_note":"Find affected GStreamer version ranges and the fixed release from the NVD entry or the upstream GStreamer advisory.","how_to_check":"- Check whether any service runs GStreamer with `gst-inspect-1.0 --version`\n- Look for applications that accept GStreamer Data Protocol input from the network or parse untrusted caps or structures\n- Confirm the installed GStreamer version against the fixed version in the vendor advisory: unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-input","local-media-only"],"who_is_affected":"Applications that deserialize untrusted GStreamer caps or structure data are exposed, and a network-facing GStreamer Data Protocol receiver is exposed without any user interaction. Desktop or server pipelines that only process trusted local media are less likely to be reached. The sources do not state the affected version ranges.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000755,"input_tokens":4563,"output_tokens":597,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected GStreamer version ranges and the fixed release from the NVD entry or the upstream GStreamer advisory.","search":"'-125704':14A,17A '-2026':13A,16A 'applic':48B,106C 'buffer':3A,30B,36B,83C,89C,101C 'cap':51B,110C 'charact':46B,94C 'contain':43B,91C 'core':29B,82C 'could':114C 'craft':2A,87C 'crash':11A,56B,115C 'cve':12A,15A 'data':4A,42B,54B,63B,90C,113C,121C,127C 'deseri':32B,85C 'error':96C 'establish':136C 'face':61B,119C 'flaw':77C 'found':79C 'free':9A,33B,76C,98C 'gstreamer':1A,18A,19B,27B,62B,81C,120C 'impact':132C 'interact':71B,130C 'invalid':45B,93C 'map':35B,100C 'media':21B 'media-pipelin':20B 'network':24B,60B,118C 'network-fac':59B,117C 'network-receiv':23B 'pars':49B,108C 'path':97C 'pipelin':22B 'possibl':10A 'process':125C 'protocol':64B,122C 'receiv':25B,65B,123C 'runtim':26B 'serial':41B,88C 'structur':53B,112C 'trigger':5A,68B 'unmap':38B,103C 'untrust':50B,109C 'use':7A,74C 'use-after-fre':6A,73C 'user':70B,129C 'valu':31B,84C 'without':69B,128C","nicknames":[],"mitigations":[],"who_affected":"Applications using GStreamer core below 1.28.3 that deserialize untrusted caps, structure or serialized buffer data are exposed; a network-facing GStreamer Data Protocol receiver can be hit without user interaction (per NVD). Pipelines that only process trusted local media can skip it. The upstream advisory says impact could range from a crash to data corruption or code execution; NVD says only a crash is established.","tier":"B","verified":{"fix":{"at":"2026-11-10T11:22:40Z","by":"analyst","doc":"https://gstreamer.freedesktop.org/security/sa-2026-0028.html","run_id":2443},"products":{"at":"2026-11-10T11:22:40Z","by":"analyst","doc":"https://gstreamer.freedesktop.org/security/sa-2026-0028.html","run_id":2443}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["gstreamer"],"ptokens":["gstreamer"],"labels":["gstreamer","high","mediapipelines","networkreceivers","runtime"],"campaign_type":null,"search_a":"'-125704':14A,17A '-2026':13A,16A 'buffer':3A 'craft':2A 'crash':11A 'cve':12A,15A 'data':4A 'free':9A 'gstreamer':1A,18A 'possibl':10A 'trigger':5A 'use':7A 'use-after-fre':6A","search_b":"'applic':48B 'buffer':30B,36B 'cap':51B 'charact':46B 'contain':43B 'core':29B 'crash':56B 'data':42B,54B,63B 'deseri':32B 'face':61B 'free':33B 'gstreamer':19B,27B,62B 'interact':71B 'invalid':45B 'map':35B 'media':21B 'media-pipelin':20B 'network':24B,60B 'network-fac':59B 'network-receiv':23B 'pars':49B 'pipelin':22B 'protocol':64B 'receiv':25B,65B 'runtim':26B 'serial':41B 'structur':53B 'trigger':68B 'unmap':38B 'untrust':50B 'user':70B 'valu':31B 'without':69B","search_c":"'applic':106C 'buffer':83C,89C,101C 'cap':110C 'charact':94C 'contain':91C 'core':82C 'could':114C 'craft':87C 'crash':115C 'data':90C,113C,121C,127C 'deseri':85C 'error':96C 'establish':136C 'face':119C 'flaw':77C 'found':79C 'free':76C,98C 'gstreamer':81C,120C 'impact':132C 'interact':130C 'invalid':93C 'map':100C 'network':118C 'network-fac':117C 'pars':108C 'path':97C 'process':125C 'protocol':122C 'receiv':123C 'serial':88C 'structur':112C 'unmap':103C 'untrust':109C 'use':74C 'use-after-fre':73C 'user':129C 'valu':84C 'without':128C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T11:16:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125704","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125704","severity":null,"published_at":"2026-11-10T11:16:43+00:00","modified_at":"2026-11-10T11:16:43+00:00","first_seen_at":"2026-11-10T11:21:35+00:00","fetched_at":"2026-11-10T11:21:35+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125704:2443","url":"https://gstreamer.freedesktop.org/security/sa-2026-0028.html","severity":null,"published_at":"2026-11-10T11:22:40+00:00","modified_at":"2026-11-10T11:22:40+00:00","first_seen_at":"2026-11-10T11:22:40+00:00","fetched_at":"2026-11-10T11:22:40+00:00","note":"Matched by description to upstream GStreamer-SA-2026-0028 (core < 1.28.3, fixed 1.28.3, dated 2026-05-11); the advisory itself says no CVE assigned, so the link to this CVE id is by matching text only. No exploitation or PoC found. Web search worked; X not checked.","cites":["https://gstreamer.freedesktop.org/security/sa-2026-0028.html"]}],"documents":[{"id":114696,"url":"https://gstreamer.freedesktop.org/security/sa-2026-0028.html","title":"GStreamer Security Advisory 2026-0028","kind":"advisory","source":"analyst","publisher":null,"text":"Use-after-free in GStreamer core buffer value deserialization. Affected: GStreamer core < 1.28.3. Fixed in 1.28.3. Page states no CVE number assigned or pending.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}