CVE-2026-52718

Published: Jun 15, 2026Modified: Jul 14, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: secalert@redhat.com (Secondary)

Description

A denial of service vulnerability was found in GStreamer's AV1 codec parser in gst-plugins-bad. The gst_av1_parser_parse_tile_list_obu() function passes a byte count to a bit-reader API that expects a bit count, causing parser desynchronization. A remote attacker could trick a user into opening a specially crafted AV1 media file, triggering an assertion abort and causing the application to crash.

Related CWEs

CWE-617

Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

References (5)

https://access.redhat.com/errata/RHSA-2026:36749

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:36834

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2026-52718

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2486328

Source: secalert@redhat.com

https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5103

Source: secalert@redhat.com

Timeline

No history available yet.