{"id":"CVE-2026-52721","title":"Gstreamer1-plugins-bad-free: gstreamer: multiple out-of-bounds reads in pcapparse ipv4/tcp header parsing","summary":"Multiple out-of-bounds read vulnerabilities were found in GStreamer's pcapparse element. Malformed PCAP records can trigger reads beyond buffer boundaries during IPv4/TCP header parsing. This element is primarily used in debugging pipeli…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H","cvssSource":"cna","cwe":["CWE-125"],"vendor":"Red Hat","product":"gstreamer1-plugins-bad-free","affected":["gstreamer1-plugins-bad-free (all versions)","gstreamer-plugins-bad-free","gstreamer1-plugins-bad-free (all versions)","gstreamer-plugins-bad-free (all versions)","gstreamer1-plugins-bad-free (all versions)","gstreamer1-plugins-bad-free (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-06-15T19:38:48.976157Z"},"published":"2026-06-15","updated":"2026-11-05","sourceUpdated":"2026-11-05T21:20:10.494Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-52721","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-52721"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486732","label":"RHBZ#2486732"},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5106"}],"tags":["cve.org"],"epss":0.00107,"epssPercentile":0.01174,"ingestedAt":"2026-11-05T22:38:32.040Z","slug":"CVE-2026-52721","body":"## Overview\n\nMultiple out-of-bounds read vulnerabilities were found in GStreamer's pcapparse element. Malformed PCAP records can trigger reads beyond buffer boundaries during IPv4/TCP header parsing. This element is primarily used in debugging pipelines, limiting real-world exposure. A local attacker could trick a user into processing a specially crafted PCAP file, potentially leading to a crash or information disclosure.\n\n## Affected\n\n- `gstreamer1-plugins-bad-free (all versions)`\n- `gstreamer-plugins-bad-free`\n- `gstreamer1-plugins-bad-free (all versions)`\n- `gstreamer-plugins-bad-free (all versions)`\n- `gstreamer1-plugins-bad-free (all versions)`\n- `gstreamer1-plugins-bad-free (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nRed Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}