Skip to content

GStreamer-SA-2026-0022 on CTRL-OS 26.05

Aliases: GStreamer-SA-2026-0022

Packages: gst_all_1.gst-plugins-good

Status: In Progress

Advisory Information

Details

Heap buffer overflow in the Matroska (MKV) demuxer when calculating decompressed buffer sizes for bz2-compressed tracks. The issue occurs due to missing parentheses in the buffer size calculation, causing incorrect memory allocation and potential out-of-bounds writes.

Impact

A malicious third party could trigger a heap buffer overflow by providing a crafted Matroska file with bz2-compressed data. This could result in application crash or arbitrary code execution.

Solution

The gst-plugins-good 1.28.2 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11248.patch

Updates

2026-07-28 00:04 CEST

Metadata changes:

  • Status for package gst_all_1.gst-plugins-good: “In Progress” (43fbe88cf94797fbd0275bfce5a428ac2eae47df)

2026-07-10 01:11 CEST

Metadata changes:

  • Status for package gst_all_1.gst-plugins-good: “Plausible”

(Amended on: 2026-07-10 01:18 CEST)

2026-07-10 01:10 CEST

Metadata changes:

  • Status for package gst_all_1.gst-plugins-good: “New”