CVE-2026-121259
MediumCVSS 6.5Summary
A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad. Crafted JPEG 2000 media can cause integer overflows or division by zero during tile processing. An application that processes the malicious media may crash, resulting in a denial of service.
Risk Assessment
Applications using GStreamer to process untrusted JPEG 2000 files may crash, leading to denial of service. This may disrupt multimedia processing services.
Recommendation
Update gst-plugins-bad to a patched version. Avoid processing untrusted JPEG 2000 files or isolate media processing processes.
Other vulnerabilities in GStreamer gst-plugins-bad
See all- CVE-2026-119777High
A flaw exists in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow.
- CVE-2026-53701Medium
An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser. In the multi-slice-in-tile processing of gst_h266_parser_parse_picture_partition(), the loop iterates without checking that the slice index stays within bounds, leading to writes past three fixed-size arrays.
Original NVD description (English source)
A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad. Crafted JPEG 2000 media can cause integer overflows or division by zero during tile processing. An application that processes the malicious media may crash, resulting in a denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS