{"affected":[{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gstreamer1","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gstreamer1","product":"Red Hat Enterprise Linux 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gstreamer1","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gstreamer1","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://gitlab.freedesktop.org/gstreamer/gstreamer","packageName":"gstreamer","product":"gstreamer","source":"CNA: redhat","vendor":"GStreamer","versions":[{"lessThan":"1.28.3","status":"affected","version":"0.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-125704","cwes":["CWE-416"],"description":"A use-after-free flaw was found in GStreamer core buffer value deserialization. When crafted serialized buffer data contains an invalid character, an error path frees a mapped buffer before unmapping it. An application that parses untrusted caps or structure data could crash; a network-facing GStreamer Data Protocol receiver can process such data without user interaction. Further impact has not been established.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1794311137526,"publishedAt":1794307400844,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-125704"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2569128"},{"source":"CNA: redhat","tags":[],"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11583.patch"},{"source":"CNA: redhat","tags":[],"url":"https://gstreamer.freedesktop.org/security/sa-2026-0028.html"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"There is no complete mitigation for applications that continue to deserialize untrusted GStreamer caps or structure strings. Restrict access to network-facing GStreamer Data Protocol receivers to trusted peers, and avoid passing externally supplied strings to gst_caps_from_string() or gst_structure_from_string() until an update is available. These measures reduce exposure only where the application can control those input paths."}],"revision":"88230626a284fb4b7f47a640655970170d7ce138b2a04691b96ea325c0800c88","sources":[{"modifiedAt":1794311137526,"name":"CNA: redhat","retrievedAt":1794312554610,"url":"https://www.cve.org/CVERecord?id=CVE-2026-125704"}],"ssvc":null,"status":"published","title":"Gstreamer: gstreamer: use-after-free in gstreamer core buffer value deserialization","updatedAt":1794312554610}