GStreamer gst-plugins-bad CVE-2026-121259

Exploitation requires an application built on GStreamer with the gst-plugins-bad JPEG 2000 decoder to decode an attacker-crafted JPEG 2000 media file or stream; the malformed tile data triggers an integer overflow or division by zero during tile processing. Per CVSS UI:R, a user must actively open or play the malicious media - it is not triggered without that interaction. Limiting factors: the JPEG 2000 decoder plugin from gst-plugins-bad must be installed and actually invoked (JPEG 2000 is not among the most common media formats), and the impact is confined to an availability crash of the processing application (C:N/I:N) with no code execution or data exposure. The only complete fix stated in the sources is updating to GStreamer 1.28.

This is a moderate-severity denial-of-service issue, not a high-priority emergency. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5) shows a network-reachable, low-complexity, unauthenticated flaw whose only impact is availability (A:H) - there is no confidentiality or integrity impact, consistent with the description's 'crash, resulting in a denial of service' and CWE-190 (integer overflow) / division-by-zero root cause. Crucially, the attack requires user interaction (UI:R): a victim application must actually process attacker-supplied JPEG 2000 media, which meaningfully lowers real-world risk versus a no-interaction remote bug. The vuln.today decision label is 'this_month' (routine remediation, not act_now/emergency). No EPSS score, no CISA KEV listing, and no public exploit reference were provided, so exploitation status is 'no public exploit identified at time of analysis'. Signals are consistent rather than conflicting: a config/content-triggered crash bug reported by Red Hat with no exploitation telemetry. The main missing data points are EPSS probability and any independent confirmation of exploitation - none is claimed, so treat this as a patch-in-normal-cycle availability bug rather than a widespread-exploitation priority.

An attacker crafts a malformed JPEG 2000 file or stream that triggers an integer overflow or division-by-zero in the gst-plugins-bad JPEG 2000 decoder during tile processing, then delivers it via a website, email attachment, or media link. When a user opens or plays the media in a GStreamer-based application, the decoder crashes and the application terminates (denial of service). No public exploit code was identified in the provided data, and the impact is limited to a crash - no code execution or data disclosure is indicated.