A vulnerability in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin allows an out-of-bounds read when parsing crafted MPEG Program Stream files. This can cause the application to crash, resulting in a denial of service. The flaw arises because the PES header parsers do not sufficiently check remaining data before reading timestamps and optional header fields. The vulnerability requires a user or media-processing pipeline to open a malicious file. No information disclosure or integrity impact has been demonstrated. Mitigations include disabling the affected MPEG Program Stream demuxer plugin until a fixed package is available.