An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser reads a segment length value from the bitstream without validating it against available data. A remote attacker could trick a user into opening a specially crafted JPEG file, causing downstream parsing to read beyond the provided input buffer, leading to a crash or potential information disclosure.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade gstreamer1-plugins-bad-free-develUpgrade gstreamer1-plugins-bad-free-libsUpgrade gstreamer1-plugins-bad-free | Jul 12, 2026 | Jul 8, 2026 |
| Amazon_linux_2023 | — | Upgrade gstreamer1-plugins-bad-free-libs-debuginfoUpgrade gstreamer1-plugins-bad-freeUpgrade gstreamer1-plugin-openh264Upgrade gstreamer1-plugins-bad-free-debuginfoUpgrade gstreamer1-plugin-openh264-debuginfoUpgrade gstreamer1-plugins-bad-free-libsUpgrade gstreamer1-plugins-bad-free-debugsourceUpgrade gstreamer1-plugins-bad-free-devel | Jul 8, 2026 | Jun 15, 2026 |
| Debian | — | Upgrade gst-plugins-bad1.0 | Jul 23, 2026 | Jul 23, 2026 |
| Freebsd | — | Upgrade gstreamer1-plugins-goodUpgrade gstreamer1-plugins-uglyUpgrade gstreamer1-libavUpgrade gstreamer1-plugins-badUpgrade gstreamer1-plugins | Jun 30, 2026 | Jun 29, 2026 |
| Redhat_linux | — | Upgrade gstreamer1-plugins-bad-freeUpgrade gstreamer1-plugins-bad-free-debuginfoUpgrade gstreamer1-plugins-bad-free-libs-debuginfoUpgrade gstreamer1-plugins-bad-free-libsUpgrade gstreamer1-plugins-bad-free-develUpgrade gstreamer1-plugins-bad-free-debugsourceNo solution exists | Jul 10, 2026 | Jun 15, 2026 |
| Rocky_linux | — | Upgrade gstreamer1-plugins-bad-free-libsUpgrade gstreamer1-plugins-bad-freeUpgrade gstreamer1-plugins-bad-free-debugsourceUpgrade gstreamer1-plugins-bad-free-debuginfoUpgrade gstreamer1-plugins-bad-free-develUpgrade gstreamer1-plugins-bad-free-libs-debuginfo | Jul 13, 2026 | Jul 10, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 6, 2026 | Jun 15, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub