CVE-2026-125040
Gst-plugins-base: gst-plugins-base: quadratic regex processing in srt/webvtt subtitle parser causes denial of service
A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle markup, the parser repeatedly searches the remaining text with unanchored regular expressions. A crafted subtitle cue with a long line of unmatched markup-like text can force quadratic CPU use and make a GStreamer-based application unresponsive.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
What each source reports
CVE List Score used
Gst-plugins-base: gst-plugins-base: quadratic regex processing in srt/webvtt subtitle parser causes denial of service
A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle markup, the parser repeatedly searches the remaining text with unanchored regular expressions. A crafted subtitle cue with a long line of unmatched markup-like text can force quadratic CPU use and make a GStreamer-based application unresponsive.
- Record
CVE-2026-125040- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-10
EUVDEUVD-2026-120150
A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle markup, the parser repeatedly searches the remaining text with unanchored regular expressions. A crafted subtitle cue with a long line of unmatched markup-like text can force quadratic CPU use and make a GStreamer-based application unresponsive.
- Record
EUVD-2026-120150- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-10
GitHub AdvisoriesGHSA-432v-qrx4-8j6c
A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While...
A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle markup, the parser repeatedly searches the remaining text with unanchored regular expressions. A crafted subtitle cue with a long line of unmatched markup-like text can force quadratic CPU use and make a GStreamer-based application unresponsive.
- Record
GHSA-432v-qrx4-8j6c- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-09
NVD
A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle markup, the parser repeatedly searches the remaining text with unanchored regular expressions. A crafted subtitle cue with a long line of unmatched markup-like text can force quadratic CPU use and make a GStreamer-based application unresponsive.
- Record
CVE-2026-125040- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-09
OSVDEBIAN-CVE-2026-125040
A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle markup, the parser repeatedly searches the remaining text with unanchored regular expressions. A crafted subtitle cue with a long line of unmatched markup-like text can force quadratic CPU use and make a GStreamer-based application unresponsive.
- Record
DEBIAN-CVE-2026-125040- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-10
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gst-plugins-base1.0Debian:12 |
All versions, plus listed versions 1.22.0-31.22.0-3+deb12u11.22.0-3+deb12u21.22.0-3+deb12u31.22.0-3+deb12u4 Show 45 moreShow less1.22.0-3+deb12u51.22.0-3+deb12u61.22.0-3+deb12u71.22.1-11.22.10-11.22.2-11.22.3-11.22.3-21.22.4-11.22.5-11.22.6-11.22.7-11.22.8-11.22.9-11.23.1-11.23.1-21.23.2-11.23.2-21.23.90-11.24.0-11.24.0-21.24.1-11.24.10-11.24.11-11.24.11-21.24.11-31.24.12-11.24.2-11.24.3-11.24.4-11.24.4-1+hurd.11.24.5-11.24.6-11.24.7-11.24.7-21.24.7-31.24.7-41.24.8-11.24.9-11.25.1-11.25.1-21.25.1-31.25.1-41.25.1-51.25.50-1 |
None known |
gst-plugins-base1.0Debian:13 |
All versions, plus listed versions 1.26.10-11.26.2-11.26.2-1+deb13u11.26.2-1+deb13u21.26.3-1 Show 32 moreShow less1.26.4-11.26.5-11.26.5-21.26.6-11.26.6-21.26.6-31.26.7-11.26.8-11.26.9-11.27.1-11.27.2-11.27.2-21.27.2-31.27.50-11.27.50-21.27.90-11.28.0-11.28.1-11.28.2-11.28.2-21.28.3-11.28.4-11.28.5-11.28.6-11.28.6-21.28.7-11.28.8-11.28.9-11.29.1-11.29.1-21.29.1-31.29.2-1 |
None known |
gst-plugins-base1.0Debian:14 |
before 1.28.2-1, plus listed versions 1.26.10-11.26.2-11.26.3-11.26.4-11.26.5-1 Show 16 moreShow less1.26.5-21.26.6-11.26.6-21.26.6-31.26.7-11.26.8-11.26.9-11.27.1-11.27.2-11.27.2-21.27.2-31.27.50-11.27.50-21.27.90-11.28.0-11.28.1-1 |
1.28.2-1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| products | EUVD | |
| products | CVE List, OSV | |
| affected, aliases, facts, references | OSV | |
| published | EUVD | |
| published | EUVD, NVD | |
| aliases, references | GitHub Advisories | |
| cwes, products, references, severity, title | CVE List | |
| first indexed | EUVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-125040 is a medium vulnerability (CVSS 6.5) in Gstreamer Gst-plugins-base, published November 9, 2026. No source lists public exploit code. Fixed in gst-plugins-base1.0 1.28.2-1.
References
Left out here: 39 versions. The JSON record has them.