Medium severity5.5NVD Advisory· Published Nov 10, 2026· Updated Nov 10, 2026

CVE-2026-125706

Description

A flaw was found in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin. The PES header parsers do not adequately check remaining data before reading timestamps and optional header fields. Opening a specially crafted MPEG Program Stream file can cause an out-of-bounds read and potentially crash the application, resulting in a denial of service.

Affected products

Gstreamer/gst-plugins-basellm-fuzzy

Patches

Vulnerability mechanics

References

access.redhat.com/security/cve/CVE-2026-125706nvd
bugzilla.redhat.com/show_bug.cginvd
gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11580.patchnvd
gstreamer.freedesktop.org/security/sa-2026-0024.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000