{"affected":[{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-121259","cwes":["CWE-190"],"description":"A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad. Crafted JPEG 2000 media can cause integer overflows or division by zero during tile processing. An application that processes the malicious media may crash, resulting in a denial of service.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.5,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},{"score":6.5,"severity":"medium","source":"NVD: secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1793726287867,"publishedAt":1793723406665,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-121259"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2565686"},{"source":"CNA: redhat","tags":[],"url":"https://gstreamer.freedesktop.org/releases/1.28/"},{"source":"CNA: redhat","tags":[],"url":"https://gstreamer.freedesktop.org/security/sa-2026-0015.html"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/security/cve/CVE-2026-121259"},{"source":"secalert@redhat.com","tags":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2565686"},{"source":"secalert@redhat.com","tags":[],"url":"https://gstreamer.freedesktop.org/releases/1.28/"},{"source":"secalert@redhat.com","tags":[],"url":"https://gstreamer.freedesktop.org/security/sa-2026-0015.html"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Applications that do not require JPEG 2000 decimation can avoid using the jp2kdecimator element and reject untrusted JPEG 2000 media before it reaches a pipeline that uses this element."}],"revision":"91363bc05f8db38245d0bc10a952d0d90a67a867a313327c8b564133a7ddf18f","sources":[{"modifiedAt":1793723406665,"name":"CNA: redhat","retrievedAt":1793725887040,"url":"https://www.cve.org/CVERecord?id=CVE-2026-121259"},{"modifiedAt":1793726287867,"name":"NVD","retrievedAt":1793730113083,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121259"}],"ssvc":null,"status":"published","title":"Gst-plugins-bad: gst-plugins-bad: integer overflows and division by zero in jpeg 2000 decimator","updatedAt":1793730113083}