CVE-2026-125704 | BDVDB-2026-402907 Detail

Description#

A use-after-free flaw was found in GStreamer core buffer value deserialization. When serialized buffer text contains an invalid character, an error path frees a mapped buffer before unmapping it. Applications that parse untrusted caps or structure data can reach a freed-buffer read and may crash. A network-facing GStreamer Data Protocol receiver can process such caps data without user interaction; further impact has not been established.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-11-10Record published in the CVE List.