CVE-2026-52719

An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser reads a segment length value from the bitstream without validating it against available data. A remote attacker could trick a user into opening a specially crafted JPEG file, causing downstream parsing to read beyond the provided input buffer, leading to a crash or potential information disclosure.

This is an Important out-of-bounds read vulnerability in the GStreamer VA JPEG decoder (gst-plugins-bad). The flaw allows a crash or potential information disclosure when processing specially crafted JPEG files due to missing bounds validation on the segment length field. The JPEG parser reads an untrusted segment length from the bitstream and downstream callers trust this value without verifying sufficient data is available. The impact affects both availability (crash) and potentially confidentiality (information disclosure from out-of-bounds memory reads). Red Hat products utilizing GStreamer for multimedia processing are affected if they handle untrusted JPEG content through the VA JPEG decoder path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates if they become available.