CVE-2026-119843
Awaiting Analysis Awaiting Analysis - Queue

FLV Media Demuxer Buffer Overflow in GStreamer

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: redhat-SADP

Description
A flaw was found in GStreamer's gst-plugins-good package. The FLV media demuxer does not properly validate buffer sizes and data availability when processing enhanced audio and video tags in malformed or truncated FLV streams. A remote attacker could exploit this vulnerability by providing a specially crafted FLV media file that, when opened or streamed by a GStreamer-based application, triggers an assertion failure or a process crash, leading to denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-119843
EUVD
EUVD-2026-115733

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
GStreamer project gst-plugins-good 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in GStreamer's gst-plugins-good package, specifically in the FLV media demuxer. It fails to properly validate buffer sizes and data when processing malformed or truncated FLV streams, particularly enhanced audio and video tags. This can cause assertion failures or crashes in GStreamer-based applications when opening or streaming specially crafted FLV files.

Detection Guidance

To detect this vulnerability, check the version of gst-plugins-good installed on your system. Run: gst-inspect-1.0 --version. If the version is below 1.28.2, the system is vulnerable. Additionally, monitor for crashes in GStreamer-based applications when processing FLV files.

Impact Analysis

If you use a GStreamer-based application to open or stream FLV media files, this vulnerability could allow a remote attacker to crash the application by providing a malicious FLV file. This results in a denial of service, disrupting your ability to use the application until it is restarted.

Compliance Impact

This vulnerability primarily causes denial of service by crashing applications processing malformed FLV files. It does not directly impact data confidentiality or integrity, which are key concerns for GDPR and HIPAA compliance. However, repeated crashes could disrupt services handling sensitive data, potentially affecting availability requirements in regulated environments.

Mitigation Strategies

Upgrade gst-plugins-good to version 1.28.2 or later. If upgrading is not immediately possible, avoid processing untrusted FLV files in GStreamer-based applications until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119843. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...