CVE-2026-52717
Description
A memory corruption vulnerability was found in GStreamer's gst-libav plugin. The gst_ffmpeg_pipe_close() function incorrectly calls g_free() on a pointer to an embedded struct member that was never heap-allocated. A remote attacker could trick a user into opening a specially crafted media file, causing the application to crash, resulting in a denial of service.
Statement
This is a Moderate memory corruption vulnerability in the GStreamer gst-libav plugin. The flaw allows denial of service (application crash) when processing non-seekable media streams due to an invalid g_free() call on an embedded struct member. The freed pointer is not attacker-controlled and is independent of the input file content, so the impact is limited to availability with no known path to code execution. The upstream maintainer notes that this scenario is unlikely to occur in real-world usage, as the affected code path would have caused immediate crashes during normal use if commonly exercised. Red Hat products utilizing GStreamer for multimedia processing are affected if they handle untrusted media content through the gst-libav demuxer.
Mitigation
Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.
Understanding the Weakness (CWE)
Integrity,Availability,Confidentiality
Technical Impact: Modify Memory; DoS: Crash, Exit, or Restart; Execute Unauthorized Code or Commands
Acknowledgements
Red Hat would like to thank Dr. Faruk Kazi (CoE-CNDS Lab, VJTI, Mumbai, India) and Ramesh Adhikari (CoE-CNDS Lab, VJTI, Mumbai, India) for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
