CVE-2026-125704
Gstreamer: gstreamer: use-after-free in gstreamer core buffer value deserialization
Affected Products
-
CVE record
-
NVD configurations
No data
-
Red Hat packages
No data
-
OpenCVE enrichment
No data
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | affected |
|
||||||
| Red Hat | Red Hat Enterprise Linux 8 | affected |
|
||||||
| Red Hat | Red Hat Enterprise Linux 9 | affected |
|
||||||
| Red Hat | Red Hat Enterprise Linux 7 | affected | — |
No data.
No data.
No data available yet.
Remediation
Vendor Workaround
There is no complete mitigation for applications that continue to deserialize untrusted GStreamer caps or structure strings. Restrict access to network-facing GStreamer Data Protocol receivers to trusted peers, and avoid passing externally supplied strings to gst_caps_from_string() or gst_structure_from_string() until an update is available. These measures reduce exposure only where the application can control those input paths.
Tracking
Advisories
Metrics
No CVSS v4.0
Attack Vector Network
Attack Complexity Low
Privileges Required None
Scope Unchanged
Confidentiality Impact None
Integrity Impact None
Availability Impact High
User Interaction None
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.531% probability within 30 days)
Key SSVC decision points have not yet been added.
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/o:redhat:enterprise_linux:10.3 | |
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:enterprise_linux:9::appstream | |
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:enterprise_linux:8::appstream | |
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A use-after-free flaw was found in GStreamer core buffer value deserialization. When crafted serialized buffer data contains an invalid character, an error path frees a mapped buffer before unmapping it. An application that parses untrusted caps or structure data could crash; a network-facing GStreamer Data Protocol receiver can process such data without user interaction. Further impact has not been established. | A use-after-free flaw was found in GStreamer core buffer value deserialization. When serialized buffer text contains an invalid character, an error path frees a mapped buffer before unmapping it. Applications that parse untrusted caps or structure data can reach a freed-buffer read and may crash. A network-facing GStreamer Data Protocol receiver can process such caps data without user interaction; further impact has not been established. |
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A use-after-free flaw was found in GStreamer core buffer value deserialization. When crafted serialized buffer data contains an invalid character, an error path frees a mapped buffer before unmapping it. An application that parses untrusted caps or structure data could crash; a network-facing GStreamer Data Protocol receiver can process such data without user interaction. Further impact has not been established. | |
| Title | Gstreamer: gstreamer: use-after-free in gstreamer core buffer value deserialization | |
| First Time appeared |
Redhat
Redhat enterprise Linux Redhat rhel Els |
|
| Weaknesses | CWE-416 | |
| CPEs | cpe:/a:redhat:enterprise_linux:10 cpe:/a:redhat:enterprise_linux:8 cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:rhel_els:7 |
|
| Vendors & Products |
Redhat
Redhat enterprise Linux Redhat rhel Els |
|
| References |
| |
| Metrics |
cvssV3_1
|
