CVE-2026-125704 Gstreamer: gstreamer: use-after-free in gstreamer core buffer value deserialization
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-125704?
CVE-2026-125704 is a high-severity vulnerability in Red Hat Enterprise Linux 10, published on 10 Nov 2026.
Official description
A use-after-free flaw was found in GStreamer core buffer value deserialization. When serialized buffer text contains an invalid character, an error path frees a mapped buffer before unmapping it. Applications that parse untrusted caps or structure data can reach a freed-buffer read and may crash. A network-facing GStreamer Data Protocol receiver can process such caps data without user interaction; further impact has not been established.
Weakness: CWE-416
Which versions are affected by CVE-2026-125704?
Linux distribution packages (14)
gstreamer1 AlmaLinux:8 | All versions | 1.16.1-3.el8_10 |
gstreamer1-devel AlmaLinux:8 | All versions | 1.16.1-3.el8_10 |
gstreamer1 Rocky Linux:10 | All versions | 0:1.26.7-5.el10_3.1 |
gstreamer1-debuginfo Rocky Linux:10 | All versions | 0:1.26.7-5.el10_3.1 |
gstreamer1-debugsource Rocky Linux:10 | All versions | 0:1.26.7-5.el10_3.1 |
gstreamer1-devel Rocky Linux:10 | All versions | 0:1.26.7-5.el10_3.1 |
gstreamer1 Rocky Linux:8 | All versions | 0:1.16.1-3.el8_10 |
gstreamer1-debuginfo Rocky Linux:8 | All versions | 0:1.16.1-3.el8_10 |
gstreamer1-debugsource Rocky Linux:8 | All versions | 0:1.16.1-3.el8_10 |
gstreamer1-devel Rocky Linux:8 | All versions | 0:1.16.1-3.el8_10 |
gstreamer1 Rocky Linux:9 | All versions | 0:1.22.12-3.el9_9.1 |
gstreamer1-debuginfo Rocky Linux:9 | All versions | 0:1.22.12-3.el9_9.1 |
gstreamer1-debugsource Rocky Linux:9 | All versions | 0:1.22.12-3.el9_9.1 |
gstreamer1-devel Rocky Linux:9 | All versions | 0:1.22.12-3.el9_9.1 |
How do I fix CVE-2026-125704?
Upgrade to a fixed version.
Is CVE-2026-125704 being exploited?
There is no known exploitation of CVE-2026-125704 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:99090, DEBIAN-CVE-2026-125704, ECHO-ce84-0aa1-737e, GHSA-hc85-6x4f-g38q, RLSA-2026:99090, RLSA-2026:99129 and 2 more.