漏洞概述 漏洞编号: Bug 2486328 (CVE-2026-52718) 漏洞名称: GStreamer Denial of service via AV1 tile_list_obu parser byte/bit confusion 报告时间: 2026-06-08 13:07 UTC 修改时间: 2026-06-15 17:16 UTC 状态: NEW 产品: Security Response 组件: vulnerability 优先级: medium 严重程度: medium 影响范围 硬件: All 操作系统: Linux 目标里程碑: --- 分配给: Product Security DevOps Team 修复方案 修复版本: unspecified 克隆自: --- 环境: --- 最后关闭: --- Embargoed: --- 漏洞描述 GStreamer AV1 tile_list_obu parser abort vulnerability. The function in (gst-plugins-bad) passes a byte count to , which expects a bit count. This causes parser desynchronization and a deterministic abort when processing a specially crafted AV1 media file. A 25-byte test case is sufficient to trigger the crash. Upstream confirmed by maintainer Sebastian Dröge (2026-06-02). Fix planned for GStreamer 1.28.4 or 1.28.5. Upstream issue: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/5183 (confidential). Reported via POISNTUMP-17926 by JUNYI LIU / Moss 1. POC代码 页面中未包含具体的POC代码或利用代码。