GST-PLUGINS-BAD · CVE-2026-125706 · Runtime
NO FIX YET
A flaw in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and the resindvd DVD plugin lets a malformed file trigger an out-of-bounds read. The result is a crash of the application that opens the file, a denial of service.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use GStreamer to open MPEG Program Stream or DVD media, including the resindvd plugin, are exposed when they process untrusted files. Systems that never open such files can skip it. The sources do not list affected versions.
Not affected if dvd-plugin-absent, no-untrusted-media
Who cares gstreamer, linux, media-playback
Unknown from the sources.
No fix yet, per the sources.
A flaw was found in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin. The PES header parsers do not adequately check remaining data before reading timestamps and optional header fields. Opening a specially crafted MPEG Program Stream file can cause an out-of-bounds read and potentially crash the application, resulting in a denial of service.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.