Bug 2569125 (CVE-2026-125706) - CVE-2026-125706 gst-plugins-bad: gst-plugins-bad: missing bounds checks in MPEG PS PES header parsing
Summary: CVE-2026-125706 gst-plugins-bad: gst-plugins-bad: missing bounds checks in MP...
Keywords:
Status: NEW
Alias: CVE-2026-125706
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2569393 2569394
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-11-09 12:55 UTC by OSIDB Bzimport
Modified: 2026-11-10 10:42 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-11-09 12:55:56 UTC 
GStreamer-SA-2026-0024: Malformed MPEG Program Stream files can trigger out-of-bounds reads in the mpegdemux element and resindvd PES filter. The issues include missing bounds checks for DTS/PTS timestamps and PES extension fields, insufficient validation while scanning timestamps, and possible integer overflows in length calculations. Impact may include crashes, denial of service, and information disclosure. Fixed in gst-plugins-bad 1.28.3.
Note You need to log in before you can comment on or make changes to this bug.