Bug 2486328 (CVE-2026-52718) - CVE-2026-52718 gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion
Summary: CVE-2026-52718 gstreamer1-plugins-bad-free: GStreamer: Denial of service via ...
Keywords:
Status: NEW
Alias: CVE-2026-52718
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-06-08 13:07 UTC by OSIDB Bzimport
Modified: 2026-07-29 19:46 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:36749 0 None None None 2026-07-08 13:56:31 UTC
Red Hat Product Errata RHSA-2026:36834 0 None None None 2026-07-08 20:27:20 UTC
Red Hat Product Errata RHSA-2026:47069 0 None None None 2026-07-28 15:12:59 UTC
Red Hat Product Errata RHSA-2026:47070 0 None None None 2026-07-28 16:09:18 UTC
Red Hat Product Errata RHSA-2026:47071 0 None None None 2026-07-28 16:15:43 UTC
Red Hat Product Errata RHSA-2026:47717 0 None None None 2026-07-29 19:46:07 UTC

Description OSIDB Bzimport 2026-06-08 13:07:10 UTC 
GStreamer AV1 tile_list_obu parser abort vulnerability. The gst_av1_parser_parse_tile_list_obu() function in gstav1parser.c (gst-plugins-bad) passes a byte count to gst_bit_reader_skip(), which expects a bit count. This causes parser desynchronization and a deterministic g_assert abort when processing a specially crafted AV1 media file. A 21-byte test case is sufficient to trigger the crash. Upstream confirmed by maintainer Sebastian Dröge (2026-06-02). Fix planned for GStreamer 1.28.4 or 1.28.5. Upstream issue: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5103 (confidential). Reported via PSIRTSUPT-17026 by JUNYI LIU / Moss 1.
Comment 2 errata-xmlrpc 2026-07-08 13:56:30 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:36749 https://access.redhat.com/errata/RHSA-2026:36749
Comment 3 errata-xmlrpc 2026-07-08 20:27:19 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:36834 https://access.redhat.com/errata/RHSA-2026:36834
Comment 4 errata-xmlrpc 2026-07-28 15:12:58 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:47069 https://access.redhat.com/errata/RHSA-2026:47069
Comment 5 errata-xmlrpc 2026-07-28 16:09:17 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:47070 https://access.redhat.com/errata/RHSA-2026:47070
Comment 6 errata-xmlrpc 2026-07-28 16:15:42 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:47071 https://access.redhat.com/errata/RHSA-2026:47071
Comment 7 errata-xmlrpc 2026-07-29 19:46:06 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:47717 https://access.redhat.com/errata/RHSA-2026:47717
Note You need to log in before you can comment on or make changes to this bug.