CVE-2026-125040
Publication date 10 November 2026
Last updated 10 November 2026
Ubuntu priority
Description
A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle markup, the parser repeatedly searches the remaining text with unanchored regular expressions. A crafted subtitle cue with a long line of unmatched markup-like text can force quadratic CPU use and make a GStreamer-based application unresponsive.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| gst-plugins-base1.0 | 26.10 stonking |
Needs evaluation
|
| 26.04 LTS resolute |
Needs evaluation
|
|
| 24.04 LTS noble |
Needs evaluation
|
|
| 22.04 LTS jammy |
Needs evaluation
|
|
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
|
| 14.04 LTS trusty | Not in release |
Severity score breakdown
CVSS version: CVSS v3.0
Base score
6.5 · Medium
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References
Other references
- https://www.cve.org/CVERecord?id=CVE-2026-125040
- access.redhat.com/downloads/content/package-browser
- gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/3a81eb4d7d2c0a34191a855d0bafbf4e8dd7231c
- gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/a41cbb42cedb1cf4a4c2ad6658ff80c7f4cf2404
- gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/d33fc5577ae38caa91b24f90a695d5ced19b76af
- gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11237
- gstreamer.freedesktop.org/security/sa-2026-0023.html
- security-tracker.debian.org/tracker/cve-2026-125040