Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

GStreamer-SA-2026-0024 affects the MPEG Program Stream demuxer and resindvd plugin in gst-plugins-bad. Their PES header parsers lack bounds checks before reading or skipping optional header fields; a DTS timestamp is read before its five-byte length check, and timestamp scanning can read beyond its end pointer. A crafted MPEG Program Stream or VOB file can trigger an out-of-bounds read and potentially crash the parsing application. Static comparison of GStreamer 1.28.2 and 1.28.3 confirms the missing checks and their fix in 1.28.3. The static review did not demonstrate an information-disclosure channel or reproduce a crash. Its initial suggestion that an out-of-bounds pointer reaches gst_buffer_fill() was withdrawn after tracing the parser's length bookkeeping. Upstream advisory: https://gstreamer.freedesktop.org/security/sa-2026-0024.html; fix: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11580.patch. No reporter is named in the public advisory.