CVE-2026-121259

A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad. Crafted JPEG 2000 media can cause integer overflows or division by zero during tile processing. An application that processes the malicious media may crash, resulting in a denial of service.

This vulnerability is rated Moderate because a crafted JPEG 2000 stream can crash an application that uses the decimator, while confidentiality and integrity impacts have not been demonstrated. Exploitation requires the application to process attacker-controlled media through the jp2kdecimator element. Red Hat Enterprise Linux and Red Hat In-Vehicle OS ship gstreamer1-plugins-bad-free versions below the upstream fixed release, so their exposure is being tracked pending confirmation of the element's presence and any downstream backports. Fedora 43 ships an older version and is being tracked; Fedora 44 and Rawhide ship versions containing the upstream fix. No product-specific mitigation has been confirmed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Applications that do not require JPEG 2000 decimation can avoid using the jp2kdecimator element and reject untrusted JPEG 2000 media before it reaches a pipeline that uses this element.