Description
An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser reads a segment length value from the bitstream without validating it against available data. A remote attacker could trick a user into opening a specially crafted JPEG file, causing downstream parsing to read beyond the provided input buffer, leading to a crash or potential information disclosure.
Problem types
Product status
Timeline
| 2026-05-19: | Reported to Red Hat. |
| 2026-06-15: | Made public. |
Credits
Red Hat would like to thank JUNYI LIU for reporting this issue.
References
access.redhat.com/security/cve/CVE-2026-52719
bugzilla.redhat.com/show_bug.cgi?id=2486353 (RHBZ#2486353)
gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5104