Back Tenable

CVE-2026-125040 | Tenable®

Tenable • November 10, 2026

A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle markup, the parser repeatedly searches the remaining text with unanchored regular expressions. A crafted subtitle cue with a long line of unmatched markup-like text can force quadratic CPU use and make a GStreamer-based application unresponsive.

Published : 2026-11-09

Vector : CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Denial of Service Vulnerability in GStreamer Subtitle Parser A denial of service vulnerability (CVE-2026-125040) was identified in the SRT and WebVTT subtitle parser of GStreamer's gst-plugins-base. The flaw arises from inefficient regular expression processing, which can lead to excessive CPU usage and application unresponsiveness when parsing crafted subtitle files with long lines. The issue was confirmed in version 1.28.1, and a fix was released in version 1.28.2. Users are advised to update to the latest version or disable the subparse element if untrusted subtitles are not needed. The vulnerability has a CVSS score of 6.5, categorized as medium severity. Red Hat has not assessed the exposure of its products to this flaw. The vulnerability was published on November 9, 2026. 1 sources 57

Extracted Entities

CVEs (1)

CVE-2026-125040

Platforms (1)

GStreamer