Use-After-Free Vulnerability in GStreamer Core Buffer Deserialization

CVE-2026-125704

What is CVE-2026-125704?

A use-after-free vulnerability exists in the GStreamer core related to buffer value deserialization. If an application processes serialized buffer data containing invalid characters, it can inadvertently free a mapped buffer before properly unmapping it. This flaw poses a risk, especially in applications that parse untrusted data, potentially leading to crashes. Notably, the vulnerability can be exploited by network-facing GStreamer Data Protocol receivers without any user interaction, highlighting the need for scrutiny in applications utilizing these components.

References