Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

GStreamer-SA-2026-0028. In GStreamer core gst_value_deserialize_buffer() (subprojects/gstreamer/gst/gstvalue.c), the invalid-hex-character error path calls gst_buffer_unref(buffer) before gst_buffer_unmap(buffer, &info), so the unmap can access freed buffer memory. A crafted serialized GstBuffer value in a caps or structure string reaches this path. In a network-facing GStreamer Data Protocol receiver, gdpdepay can pass supplied CAPS data through gst_dp_caps_from_packet() to gst_caps_from_string() without prior content validation. Static review of upstream 1.28.2 confirmed the ordering bug and the network entry path; no dynamic PoC, ASan trace, information disclosure, or code-execution primitive was established. Upstream versions before 1.28.3 are affected; 1.28.3 contains the fix (merge request !11583). The public advisory does not identify a reporter.