CVE-2026-52717

[CVE catalog]

Severity

Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Published

Jun 12, 2026, 12:00:00 AM UTC

Source

[NVD] · [CVE record]

A memory corruption vulnerability was found in GStreamer's gst-libav plugin. The gst_ffmpeg_pipe_close() function incorrectly calls g_free() on a pointer to an embedded struct member that was never heap-allocated. A remote attacker could trick a user into opening a specially crafted media file, causing the application to crash, resulting in a denial of service. This is a Moderate memory corruption vulnerability in the GStreamer gst-libav plugin. The flaw allows denial of service (application crash) when processing non-seekable media streams due to an invalid g_free() call on an embedded struct member. The freed pointer is not attacker-controlled and is independent of the input file content, so the impact is limited to availability with no known path to code execution. The upstream maintainer notes that this scenario is unlikely to occur in real-world usage, as the affected code path would have caused immediate crashes during normal use if commonly exercised. Red Hat products utilizing GStreamer for multimedia processing are affected if they handle untrusted media content through the gst-libav demuxer. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.