CVE-2026-119729
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker can cause integer overflow in the parser, resulting in incorrect length values being used during stream processing, which can lead to a denial of service.
Risk Assessment
Applications processing AV1 media content (e.g., players, transcoding servers) can be remotely crashed via a malicious media file, resulting in denial of service.
Recommendation
Update GStreamer to a version containing the fix and avoid processing untrusted AV1 files until the update is applied.
Other vulnerabilities in GStreamer
See all- CVE-2026-17072Low
In GStreamer's gst-plugins-good, a heap-based out-of-bounds read of 4 bytes occurs when parsing FLAC audio stream headers embedded in Matroska or WebM container files. A boundary check does not account for the full size of the copied data, allowing a small read past the end of the allocated buffer. An attacker can exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it.
- CVE-2017-5843High
Multiple use-after-free vulnerabilities in the gst_mini_object_unref, gst_tag_list_unref, and gst_mxf_demux_update_essence_tracks functions in GStreamer before 1.10.3 allow remote attackers to cause a denial of service (crash) via vectors involving stream tags.
- CVE-2017-5840High
The qtdemux_parse_samples function in gst/isomp4/qtdemux.c in GStreamer before version 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving the current stts index.
- CVE-2017-5838High
The gst_date_time_new_from_iso8601_string function in GStreamer before version 1.10.3 allows remote attackers to cause a denial of service via a malformed datetime string, leading to an out-of-bounds heap read.
- CVE-2016-9447High
The ROM mappings in the NSF decoder in gstreamer 0.10.x allow remote attackers to cause a denial of service (out-of-bounds read or write) and possibly execute arbitrary code via a crafted NSF music file.
- CVE-2016-9446High
The vmnc decoder in gstreamer does not initialize the render canvas, allowing remote attackers to obtain sensitive information. This is demonstrated by thumbnailing a simple 1 frame vmnc movie that does not draw to the allocated render canvas.
- CVE-2016-9445High
Integer overflow in the vmnc decoder in gstreamer allows remote attackers to cause a denial of service (crash) via large width and height values, which triggers a buffer overflow.
- CVE-2016-9809High
Off-by-one error in the gst_h264_parse_set_caps function in GStreamer before version 1.10.2 allows remote attackers to have unspecified impact via a crafted file, leading to an out-of-bounds read.
- CVE-2016-9808High
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via a crafted series of skip and count pairs.
- CVE-2026-111183Critical
The rtpL16depay element in GStreamer has a heap-based buffer overflow due to missing validation of user-supplied data length before copying. This allows a remote attacker to execute arbitrary code in the context of the current process.
Original NVD description (English source)
A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker can cause integer overflow in the parser, resulting in incorrect length values being used during stream processing, which can lead to a denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS