Read the docs
TI-2026-84195 Aliases CVE-2026-119843GHSA-j9j5-89xh-84jf

Reachable assertion in GStreamer FLV demuxer crashes on malformed tags

Priority LOW 30CWE-617Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-617.

Summary

The gst-plugins-good package of the GStreamer project is affected before 1.28.2. Its FLV media demuxer does not properly validate buffer sizes and data availability when it parses enhanced audio and video tags in malformed or truncated streams, which leads to a reachable assertion (CWE-617). A remote attacker can provide a crafted FLV file that a GStreamer-based application opens or streams, causing an assertion failure or process crash and a denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

A flaw was found in GStreamer's gst-plugins-good package. The FLV media demuxer does not properly validate buffer sizes and data availability when processing enhanced audio and video tags in malformed or truncated FLV streams. A remote attacker could exploit this vulnerability by providing a specially crafted FLV media file that, when opened or streamed by a GStreamer-based application, triggers an assertion failure or a process crash, leading to denial of service.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00563 47th percentileScored 2026-11-07
Fix Fixed gst-plugins-good (GStreamer project): 1.28.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat Enterprise Linux 10——Not affectedCNA
Red HatRed Hat Enterprise Linux 7——Not affectedCNA
Red HatRed Hat Enterprise Linux 8——Not affectedCNA
Red HatRed Hat Enterprise Linux 9——Not affectedCNA
GStreamer projectgst-plugins-goodbefore 1.28.21.28.2Patch availableCNA
  • Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — Not affected CNA
  • gst-plugins-good VendorGStreamer project Affected before 1.28.2 Fixed in 1.28.2 Patch available CNA

CPE names CNA · 4

CPEVersionsRoleVendor
cpe:/o:redhat:enterprise_linux:1010—Red Hat
cpe:/o:redhat:enterprise_linux:77—Red Hat
cpe:/o:redhat:enterprise_linux:88—Red Hat
cpe:/o:redhat:enterprise_linux:99—Red Hat
  • cpe:/o:redhat:enterprise_linux:10 Versions 10 — ·Red Hat
  • cpe:/o:redhat:enterprise_linux:7 Versions 7 — ·Red Hat
  • cpe:/o:redhat:enterprise_linux:8 Versions 8 — ·Red Hat
  • cpe:/o:redhat:enterprise_linux:9 Versions 9 — ·Red Hat

Remediation

Update gst-plugins-good to version 1.28.2 or later. Red Hat lists Red Hat Enterprise Linux 7, 8, 9 and 10 as not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA gst-plugins-good (GStreamer project) Fixed in 1.28.2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 4 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-119843
  2. 2026-11-03 Alias added: GHSA-j9j5-89xh-84jf
  3. 2026-11-03 CISA SSVC decision points changed
  4. 2026-11-03 Priority changed: MEDIUM → LOW

References

Other 4

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences