{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-125712",
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "state": "PUBLISHED",
        "assignerShortName": "redhat",
        "dateReserved": "2026-11-10T10:37:49.396Z",
        "datePublished": "2026-11-10T11:22:59.567Z",
        "dateUpdated": "2026-11-10T11:45:41.962Z"
    },
    "containers": {
        "cna": {
            "affected": [
                {
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:10"
                    ],
                    "defaultStatus": "affected",
                    "packageName": "gstreamer1-plugins-base",
                    "product": "Red Hat Enterprise Linux 10",
                    "vendor": "Red Hat"
                },
                {
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "cpes": [
                        "cpe:/o:redhat:rhel_els:6"
                    ],
                    "defaultStatus": "unknown",
                    "packageName": "gstreamer-plugins-base",
                    "product": "Red Hat Enterprise Linux 6",
                    "vendor": "Red Hat"
                },
                {
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "cpes": [
                        "cpe:/o:redhat:rhel_els:7"
                    ],
                    "defaultStatus": "affected",
                    "packageName": "gstreamer1-plugins-base",
                    "product": "Red Hat Enterprise Linux 7",
                    "vendor": "Red Hat"
                },
                {
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "cpes": [
                        "cpe:/o:redhat:rhel_els:7"
                    ],
                    "defaultStatus": "affected",
                    "packageName": "gstreamer-plugins-base",
                    "product": "Red Hat Enterprise Linux 7",
                    "vendor": "Red Hat"
                },
                {
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:8"
                    ],
                    "defaultStatus": "affected",
                    "packageName": "gstreamer1-plugins-base",
                    "product": "Red Hat Enterprise Linux 8",
                    "vendor": "Red Hat"
                },
                {
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ],
                    "defaultStatus": "affected",
                    "packageName": "gstreamer1-plugins-base",
                    "product": "Red Hat Enterprise Linux 9",
                    "vendor": "Red Hat"
                },
                {
                    "vendor": "GStreamer",
                    "product": "gst-plugins-base",
                    "packageName": "gst-plugins-base",
                    "collectionURL": "https://gitlab.freedesktop.org/gstreamer/gstreamer",
                    "defaultStatus": "unaffected",
                    "versions": [
                        {
                            "version": "0.0.0",
                            "versionType": "semver",
                            "lessThan": "1.28.4",
                            "status": "affected"
                        }
                    ]
                }
            ],
            "datePublic": "2026-06-12T00:00:00.000Z",
            "descriptions": [
                {
                    "lang": "en",
                    "value": "A flaw was found in GStreamer's gst-plugins-base RTCP SDES packet parser. A remote sender able to reach an active media session can supply a malformed SDES entry whose declared length exceeds the received packet. Missing bounds validation can cause the receiver to read beyond the packet buffer, potentially crashing the application or exposing a limited amount of process memory."
                }
            ],
            "metrics": [
                {
                    "other": {
                        "content": {
                            "namespace": "https://access.redhat.com/security/updates/classification/",
                            "value": "Important"
                        },
                        "type": "Red Hat severity rating"
                    }
                },
                {
                    "cvssV3_1": {
                        "attackComplexity": "LOW",
                        "attackVector": "NETWORK",
                        "availabilityImpact": "HIGH",
                        "baseScore": 8.2,
                        "baseSeverity": "HIGH",
                        "confidentialityImpact": "LOW",
                        "integrityImpact": "NONE",
                        "privilegesRequired": "NONE",
                        "scope": "UNCHANGED",
                        "userInteraction": "NONE",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
                        "version": "3.1"
                    },
                    "format": "CVSS"
                }
            ],
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "cweId": "CWE-125",
                            "description": "Out-of-bounds Read",
                            "lang": "en",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "providerMetadata": {
                "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
                "shortName": "redhat",
                "dateUpdated": "2026-11-10T11:45:41.962Z"
            },
            "references": [
                {
                    "tags": [
                        "vdb-entry",
                        "x_refsource_REDHAT"
                    ],
                    "url": "https://access.redhat.com/security/cve/CVE-2026-125712"
                },
                {
                    "name": "RHBZ#2569130",
                    "tags": [
                        "issue-tracking",
                        "x_refsource_REDHAT"
                    ],
                    "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2569130"
                },
                {
                    "url": "https://gstreamer.freedesktop.org/security/sa-2026-0030.html"
                }
            ],
            "timeline": [
                {
                    "lang": "en",
                    "time": "2026-06-12T00:00:00.000Z",
                    "value": "Reported to Red Hat."
                },
                {
                    "lang": "en",
                    "time": "2026-06-12T00:00:00.000Z",
                    "value": "Made public."
                }
            ],
            "title": "Gst-plugins-base: gst-plugins-base: missing bounds checks in rtcp sdes packet parsing",
            "workarounds": [
                {
                    "lang": "en",
                    "value": "There is no complete mitigation while RTCP processing remains exposed. If RTP/RTCP is not needed, disable the affected RTP session handling elements. Otherwise, restrict the negotiated RTCP port to trusted peers with network controls. These measures reduce exposure but do not correct the parser flaw."
                }
            ],
            "x_generator": {
                "engine": "cvelib 1.8.0"
            },
            "x_redhatCweChain": "CWE-125: Out-of-bounds Read"
        }
    }
}