Bug 2569393

Summary: CVE-2026-125706 gstreamer1-plugins-bad-free: gst-plugins-bad: missing bounds checks in MPEG PS PES header parsing [fedora-43]
Product: [Fedora] Fedora Reporter: lcelant
Component: gstreamer1-plugins-bad-freeAssignee: Yaakov Selkowitz <yselkowi>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: 43CC: dominik, gwync, multimedia-sig, negativo17, wtaymans, yselkowi
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["f68c8b5a-0f2f-45bb-9de7-132d3ba25a86"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2569125    

Description lcelant 2026-11-10 10:42:04 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

GStreamer-SA-2026-0024 affects the MPEG Program Stream demuxer and resindvd plugin in gst-plugins-bad. Their PES header parsers lack bounds checks before reading or skipping optional header fields; a DTS timestamp is read before its five-byte length check, and timestamp scanning can read beyond its end pointer. A crafted MPEG Program Stream or VOB file can trigger an out-of-bounds read and potentially crash the parsing application. Static comparison of GStreamer 1.28.2 and 1.28.3 confirms the missing checks and their fix in 1.28.3. The static review did not demonstrate an information-disclosure channel or reproduce a crash. Its initial suggestion that an out-of-bounds pointer reaches gst_buffer_fill() was withdrawn after tracing the parser's length bookkeeping. Upstream advisory: https://gstreamer.freedesktop.org/security/sa-2026-0024.html; fix: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11580.patch. No reporter is named in the public advisory.