GStreamer VA JPEG decoder out-of-bounds read vulnerability. In gstjpegparser.c (gst-plugins-bad), the gst_jpeg_parse() function reads a segment length from the bitstream without validating it against available data. The VA JPEG decoder path trusts this untrusted seg->size value and constructs a byte reader over an inflated range, reading past the buffer. The code's own comment explicitly acknowledges this: "a valid segment may be returned with a length that exceeds the available data." Upstream confirmed by maintainer Sebastian Dröge (2026-06-02), who noted it is "actually a bug in the VA JPEG decoder in gst-plugins-bad" and "an OOB read that could lead to a crash or possibly information disclosure." Fix planned for GStreamer 1.28.4 or 1.28.5. Upstream issue: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5104 (confidential). Reported via PSIRTSUPT-17026 by JUNYI LIU / Moss 1.