Tenable Denial of Service Vulnerability in GStreamer Subtitle Parser
Article Content
- •CVE-2026-125040 affects GStreamer's subtitle parser, causing denial of service.
- •The flaw can lead to significant CPU usage due to quadratic regex processing.
- •Users should update to GStreamer version 1.28.2 or later to mitigate the issue.
A denial of service vulnerability (CVE-2026-125040) was identified in the SRT and WebVTT subtitle parser of GStreamer's gst-plugins-base. The flaw arises from inefficient regular expression processing, which can lead to excessive CPU usage and application unresponsiveness when parsing crafted subtitle files with long lines. The issue was confirmed in version 1.28.1, and a fix was released in version 1.28.2. Users are advised to update to the latest version or disable the subparse element if untrusted subtitles are not needed. The vulnerability has a CVSS score of 6.5, categorized as medium severity. Red Hat has not assessed the exposure of its products to this flaw. The vulnerability was published on November 9, 2026.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (6)
Following this threat?
Track CVE-2026-125040 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What versions of GStreamer are affected?
What is the nature of the vulnerability?
How can I mitigate this vulnerability?
Continue Reading
Critical RCE Vulnerability in Confection WordPress Plugin (CVE-2026-115252) A critical vulnerability, CVE-2026-115252, has been identified in the Confection WordPress Cable plugin, affecting versions 0.4.0 to 0.4.7. This flaw allows unauthenticated attackers to execute arbitrary PHP code on the server by writing unmodified settings into a PHP file without proper checks. The vulnerability has… 
Critical Code Injection Vulnerability in Staggs Plugin for WordPress A critical code injection vulnerability, CVE-2026-78287, has been identified in the Staggs plugin for WordPress, affecting versions up to 3.3.0. This flaw allows unauthenticated attackers to execute arbitrary code remotely, posing severe risks to affected sites. The vulnerability stems from improper control over code…