Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft JPEG with oversized segment length
  2. Delivery
    Deliver via email, chat, or web
  3. Exploit
    Victim previews or opens file
  4. Execution
    GStreamer VA JPEG decoder parses segment
  5. Persist
    Parser reads past input buffer
  6. Impact
    Decoder crash or small memory disclosure

Vulnerability Assessment

Weakness
CWE
CWE-125
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK

1 technique across 1 tactic: Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Victim must open or auto-preview a crafted JPEG in an application that uses GStreamer gst-plugins-bad's VA (VA-API) JPEG decoder element - typically GNOME thumbnailing, totem/Videos, or another media app that selects the gstreamer-va JPEG path on RHEL 6-10. Limiting factors: UI:R requires user interaction (opening/previewing), the VA decoder element must actually be selected over the software JPEG decoder (which usually means VA-API hardware decoding is available and not disabled), and impact is bounded to a decoder-process crash plus low-confidence small OOB read - there is no code execution primitive described and no privilege escalation, since the decoder runs at the user's own privilege level.
Impact

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H) score of 7.1 captures the realistic threat model: network-reachable through any application that auto-decodes JPEGs via GStreamer (chat clients, file managers with thumbnailers, browsers using GStreamer backends), but gated on user interaction to open or preview the file, with high availability impact (decoder crash) and only a low confidentiality impact (bounded OOB read). No EPSS score, KEV listing, or SSVC decision was provided, and no POC is referenced in the supplied data, so this is best treated as a medium-priority patch - meaningful because of the wide install base on RHEL 6-10, but not currently weaponized. The primary uncertainty is whether the out-of-bounds read is reliably reachable from the GStreamer-VA element on default RHEL media pipelines or only when VA-API hardware decoding is selected; the Red Hat Bugzilla 2486353 and the upstream GitLab work item 5104 should be consulted for that triage detail.
Exploit ScenarioDerived

An attacker emails or messages a target a benign-looking .jpg whose JPEG segment length field is inflated past the real buffer size; when the victim previews the image in a GNOME thumbnailer, media player, or messaging client that routes JPEG decoding through GStreamer's VA decoder, the parser reads past the buffer, crashing the media pipeline and potentially returning adjacent heap bytes via decoded pixel data or diagnostic output. No public exploit identified at time of analysis, and exploitation is bounded by UI:R - the victim must trigger the decode action.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 15, 2026

Out-of-bounds read in the VA JPEG decoder shipped in GStreamer's gst-plugins-bad allows a remote attacker to crash the decoder or potentially leak adjacent memory contents when a victim opens a maliciously crafted JPEG file. The flaw stems from the JPEG parser trusting a segment-length value from the bitstream without verifying it fits within the buffer, and affects Red Hat Enterprise Linux 6 through 10 where the plugin is consumed. There is no public exploit identified at time of analysis and the issue is not in CISA KEV.

RemediationAI

No vendor-released patch identified at time of analysis in the supplied data - monitor the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-52719 and Bugzilla 2486353 for fixed gstreamer1-plugins-bad-free package versions for each RHEL stream, and the upstream fix progress at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5104. Until a backport is available, compensating controls are to avoid opening untrusted JPEGs in applications that use GStreamer's VA decoder, disable VA-API JPEG decoding by forcing software JPEG decoding (e.g. setting GST_VAAPI_DISABLE_CODECS or removing/blacklisting the gstreamer-vaapi/gst-plugin-va JPEG element) so that the affected code path is not selected - with the trade-off of losing hardware-accelerated JPEG decoding and slightly higher CPU on image-heavy workloads - and disabling GNOME/Nautilus image thumbnailers in shared file-server contexts to prevent drive-by decoding of attacker-supplied files.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

GStreamer is the multimedia framework used across the GNOME desktop and many Linux media pipelines; gst-plugins-bad contains the VA-API (Video Acceleration) JPEG decoder element that hands compressed JPEG segments to hardware-accelerated decoding. JPEG bitstreams are organized as a series of marker segments where each marker is followed by a 16-bit length field describing the size of the segment payload. CWE-125 (Out-of-bounds Read) applies here because the parser reads that declared length and then walks into the segment without confirming the declared size is bounded by the remaining input buffer, so downstream parsing dereferences memory past the end of the supplied data - classically a source of crashes (SIGSEGV) and, when the read lands in mapped pages, of small information leaks fed back into decoded pixel data or error paths.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
vuln.today AI 7.1 HIGH

JPEG arrives over the network but the victim must open it (UI:R), no auth needed (PR:N); OOB read crashes the decoder (A:H) and may leak limited adjacent memory (C:L) with no integrity impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.1 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High

DescriptionCVE.org

An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser reads a segment length value from the bitstream without validating it against available data. A remote attacker could trick a user into opening a specially crafted JPEG file, causing downstream parsing to read beyond the provided input buffer, leading to a crash or potential information disclosure.

Executive ViewAI

Why It Matters

GStreamer's VA JPEG decoder vulnerability (CVE-2026-52719, CVSS 7.1) affects Red Hat Enterprise Linux 6 through 10 across the organization, creating risk of service disruption and unauthorized data exposure when processing malicious JPEG files. Any systems relying on GStreamer for media or image processing could experience application crashes or memory leakage, impacting operational availability and data confidentiality.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Disable VA JPEG decoder via GStreamer configuration, enforce strict JPEG source validation and reject untrusted file processing, implement application-level input validation for JPEG handling, and maintain active monitoring of Red Hat security bulletins for patch availability.

Threat Intelligence Overview

EPSS Score
0.3%
Top 81% exploitable
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Partial

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-52719 ADVISORY https://vuldb.com/vuln/371226 REF https://access.redhat.com/errata/RHSA-2026:36749 REF https://access.redhat.com/errata/RHSA-2026:36834 REF https://access.redhat.com/errata/RHSA-2026:47070 REF https://access.redhat.com/errata/RHSA-2026:47071 REF https://access.redhat.com/errata/RHSA-2026:47717 REF https://access.redhat.com/security/cve/CVE-2026-52719 REF https://bugzilla.redhat.com/show_bug.cgi?id=2486353 REF https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5104 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52719.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy