Demuxer Vulnerability in GStreamer Affects Multimedia Applications
CVE-2026-125706

5.5MEDIUM

Key Information:

Vendor: Red Hat
Status: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8
Vendor: CVE Published:; 10 November 2026

What is CVE-2026-125706?

A vulnerability exists in the MPEG Program Stream demuxer and the resindvd DVD-playback plugin within GStreamer’s gst-plugins-bad. This flaw arises from the inadequate verification of remaining data by the PES header parsers prior to reading timestamps and optional header fields. An attacker can exploit this vulnerability by opening a maliciously crafted MPEG Program Stream file, potentially leading to an out-of-bounds read that may cause the application to crash, resulting in a denial of service.