CVE-2026-52719 Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds read via jpeg segment length validation in va decoder
A remote attacker can cause a crash or disclose memory contents by tricking a user into opening a crafted JPEG file processed by the GStreamer VA decoder.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-52719?
CVE-2026-52719 is a high-severity vulnerability in Red Hat Enterprise Linux 10, published on 15 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser reads a segment length value from the bitstream without validating it against available data. A remote attacker could trick a user into opening a specially crafted JPEG file, causing downstream parsing to read beyond the provided input buffer, leading to a crash or potential information disclosure.
Weakness: CWE-125
Which versions are affected by CVE-2026-52719?
Linux distribution packages (10)
gstreamer-plugins-bad SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 1.22.0-150500.3.31.1 |
gstreamer-plugins-bad SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 1.22.0-150500.3.31.1 |
gstreamer-plugins-bad SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 1.24.0-150600.4.6.1 |
gstreamer-plugins-bad SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | All versions | 1.24.0-150600.4.6.1 |
gstreamer-plugins-bad SUSE:Linux Enterprise Module for Package Hub 15 SP7 | All versions | 1.24.0-150600.4.6.1 |
gstreamer-plugins-bad SUSE:Linux Enterprise Server 15 SP5-LTSS | All versions | 1.22.0-150500.3.31.1 |
gstreamer-plugins-bad SUSE:Linux Enterprise Server 15 SP6-LTSS | All versions | 1.24.0-150600.4.6.1 |
gstreamer-plugins-bad SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | All versions | 1.22.0-150500.3.31.1 |
gstreamer-plugins-bad SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | All versions | 1.24.0-150600.4.6.1 |
gstreamer-plugins-bad openSUSE:Leap 16.0 | All versions | 1.26.7-160000.2.1 |
How do I fix CVE-2026-52719?
Apply the vendor's patch.
Is CVE-2026-52719 being exploited?
There is no known exploitation of CVE-2026-52719 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-52719, ECHO-c6e4-fb80-f88a, GHSA-33x5-f9c4-3q24, SUSE-SU-2026:2743-1, SUSE-SU-2026:2744-1, UBUNTU-CVE-2026-52719 and 1 more.