AZL-113356

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-113356.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-113356

Upstream

CVE-2026-125040

Published

2026-11-09T19:16:48Z

Modified

2026-11-13T14:17:22Z

Summary

CVE-2026-125040 affecting package gstreamer1-plugins-base 1.20.0-3

Details

A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle markup, the parser repeatedly searches the remaining text with unanchored regular expressions. A crafted subtitle cue with a long line of unmatched markup-like text can force quadratic CPU use and make a GStreamer-based application unresponsive.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-125040

Affected packages

Azure Linux:3 / gstreamer1-plugins-base

Package

Name: gstreamer1-plugins-base
Purl: pkg:rpm/azure-linux/gstreamer1-plugins-base

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

1.20.0-3

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-113356.json"