CVE-2026-119843 Gst-plugins-good: assertion failures in FLV demuxer when parsing malformed enhanced audio/video tags
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-119843?
CVE-2026-119843 is a medium-severity vulnerability in GStreamer project Red Hat Enterprise Linux 10, published on 3 Nov 2026.
Official description
A flaw was found in GStreamer's gst-plugins-good package. The FLV media demuxer does not properly validate buffer sizes and data availability when processing enhanced audio and video tags in malformed or truncated FLV streams. A remote attacker could exploit this vulnerability by providing a specially crafted FLV media file that, when opened or streamed by a GStreamer-based application, triggers an assertion failure or a process crash, leading to denial of service.
Weakness: CWE-617
Which versions are affected by CVE-2026-119843?
How do I fix CVE-2026-119843?
Upgrade to a fixed version.
Is CVE-2026-119843 being exploited?
There is no known exploitation of CVE-2026-119843 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-119843, ECHO-d939-1ea7-9f80, GHSA-j9j5-89xh-84jf, UBUNTU-CVE-2026-119843.