GStreamer gst-plugins-good FLV Demuxer Buffer Size Validation Bypass
CVE-2026-119843 Published on November 3, 2026
Gst-plugins-good: assertion failures in FLV demuxer when parsing malformed enhanced audio/video tags
A flaw was found in GStreamer's gst-plugins-good package. The FLV media demuxer does not properly validate buffer sizes and data availability when processing enhanced audio and video tags in malformed or truncated FLV streams. A remote attacker could exploit this vulnerability by providing a specially crafted FLV media file that, when opened or streamed by a GStreamer-based application, triggers an assertion failure or a process crash, leading to denial of service.
Vulnerability Analysis
CVE-2026-119843 can be exploited with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Timeline
Reported to Red Hat.
Made public.
Weakness Type
What is an assertion failure Vulnerability?
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
CVE-2026-119843 has been classified to as an assertion failure vulnerability or weakness.
Products Associated with CVE-2026-119843
Want to know whenever a new CVE is published for Red Hat Enterprise Linux (RHEL)? stack.watch will email you.
Affected Versions
Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 7: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 9: GStreamer project gst-plugins-good:- Before 1.28.2 is affected.
- Version 1.28.2 is unaffected.