CVE-2026-125704
Description
A use-after-free flaw was found in GStreamer core buffer value deserialization. When crafted serialized buffer data contains an invalid character, an error path frees a mapped buffer before unmapping it. An application that parses untrusted caps or structure data could crash; a network-facing GStreamer Data Protocol receiver can process such data without user interaction. Further impact has not been established.
Statement
This vulnerability is rated Important because crafted serialized GStreamer buffer data can trigger a use-after-free and terminate the parsing process. A network-facing GStreamer Data Protocol receiver can reach the vulnerable parser without authentication or user interaction; exposure in other applications depends on whether they parse untrusted caps or structure strings. Based on current newcli manifest versions compared with the upstream affected range, gstreamer1 is affected in RHEL 7 ELS, RHEL 8.4/8.6/8.8/8.10, RHEL 9.2/9.4/9.6/9.8/9.9/9.10, RHEL 10.0/10.2/10.3, and Fedora 43. RHEL 10.4, RHIVOS 2.1 and 2.1-core, Fedora 44, and Fedora Rawhide ship versions at or above the upstream fixed release and are not affected.
Mitigation
There is no complete mitigation for applications that continue to deserialize untrusted GStreamer caps or structure strings. Restrict access to network-facing GStreamer Data Protocol receivers to trusted peers, and avoid passing externally supplied strings to gst_caps_from_string() or gst_structure_from_string() until an update is available. These measures reduce exposure only where the application can control those input paths.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat CVSS v3 Score Explanation
Static verification of GStreamer 1.28.2 confirms the unref-before-unmap use-after-free in gst_value_deserialize_buffer(). AV:N, PR:N, and UI:N reflect a network-facing GDP receiver path: gdpdepay passes an unvalidated CAPS payload to gst_caps_from_string(), which can reach the vulnerable buffer deserializer automatically. Exposure depends on an application deploying that path or another untrusted deserialization path. AC:L: one invalid hex character reaches the error path without a race. S:U: impact remains in the parsing process. A:H: freed memory access can terminate that process. C:N and I:N: information disclosure and code execution were not demonstrated by the static review; reassess if dynamic evidence establishes either impact. Verification was static only; no PoC or ASan run was performed.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory
The use of previously freed memory may corrupt valid data, if the memory area in question has been allocated and used properly elsewhere.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
If chunk consolidation occurs after the use of previously freed data, the process may crash when invalid data is used as chunk information.
Confidentiality
Technical Impact: Read Memory
Read operations on freed memory can sometimes leak sensitive information instead of causing a crash
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
If malicious data is entered before chunk consolidation can take place, it may be possible to take advantage of a write-what-where primitive to execute arbitrary code. If the newly allocated data happens to hold a class, in C++ for example, various function pointers may be scattered within the heap data. If one of these function pointers is overwritten with an address to valid shellcode, execution of arbitrary code can be achieved.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
