CVE-2026-52719: Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds read via jpeg segment length validation in va decoder
Vulnerability summary
CVE-2026-52719 is a high (CVSS 7.1) Out-of-bounds Read vulnerability in gst-plugins-bad1.0. EPSS estimates a 0.63% chance of exploitation in the next 30 days, higher than 49.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 5Timeline
- 15-06-2026PublishedVulnerability first disclosed.
- 30-07-2026Last modifiedVulnerability information updated.
Description
An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser reads a segment length value from the bitstream without validating it against available data. A remote attacker could trick a user into opening a specially crafted JPEG file, causing downstream parsing to read beyond the provided input buffer, leading to a crash or potential information disclosure.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
- NVDNIST7.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
EPSS trend
Probability
0.63%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
Increase +0.29 pp
From 0.34% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Suse9 products
- gstreamer-plugins-bad&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 1.22.0-150500.3.31.1
- gstreamer-plugins-bad&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS< 1.22.0-150500.3.31.1
- gstreamer-plugins-bad&distro=SUSE Linux Enterprise Module for Basesystem 15 SP7< 1.24.0-150600.4.6.1
- gstreamer-plugins-bad&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP7< 1.24.0-150600.4.6.1
- gstreamer-plugins-bad&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7< 1.24.0-150600.4.6.1
Debian1 product
- gst-plugins-bad1.0All versions (No fix recorded) | < 1.22.0-4+deb12u8 | < 1.26.2-3+deb13u2 | < 1.28.4-1
Opensuse1 product
- gstreamer-plugins-bad&distro=openSUSE Leap 16.0< 1.26.7-160000.2.1
Ubuntu1 product
- gst-plugins-bad1.0All versions (No fix recorded)
4 vendors · 12 products
