CVE-2026-52719: Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds read via jpeg segment length validation in va decoder

Synopsis

An out-of-bounds read vulnerability exists in the VA JPEG decoder component of GStreamer's gst-plugins-bad package. The flaw is reachable over the network but requires a user to open a specially crafted JPEG file; no authentication is needed on the attacker's side. Successful exploitation crashes the affected application or leaks memory contents to the attacker. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious JPEG over the network, so the vulnerable service or user agent must be reachable or the user must fetch attacker-controlled content from a remote source.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs to get the target to open a crafted file.

• Victim interactionRequired

  A user must be socially engineered into opening or previewing a specially crafted JPEG file for the malicious input to reach the vulnerable parser.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environment-specific preconditions beyond delivering the crafted file.

Blast Radius

• The affected GStreamer process crashes, making any application that relies on it for media decoding unavailable until restarted.
• Memory contents from beyond the input buffer are read by the parser, which can expose in-process data such as heap contents to an attacker who can observe the output or error state.
• Any container workload that processes user-supplied or remotely fetched JPEG content through gst-plugins-bad is within scope of this impact.