CVE-2026-52719

June 15, 2026, 9:09 p.m.

7.1
High

Description

An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser reads a segment length value from the bitstream without validating it against available data. A remote attacker could trick a user into opening a specially crafted JPEG file, causing downstream parsing to read beyond the provided input buffer, leading to a crash or potential information disclosure.

Product(s) Impacted

Vendor Product Versions
Gstreamer
  • Gst-plugins-bad
  • *

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-125
Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a gstreamer gst-plugins-bad / / / / / / / /

References

https://access.redhat.com/security/cve/CVE-2026-52719
https://bugzilla.redhat.com/show_bug.cgi?id=2486353
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5104

Tags

[email protected]
CWE-125
2026-06-15
CVE-2026-52719

CVSS Score

7.1 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: LOW
  • Integrity Impact: NONE
  • Availability Impact: HIGH

    • CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

    View Vector String

Timeline

Published: June 15, 2026, 8:16 p.m.
Last Modified: June 15, 2026, 9:09 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.