CVE-2026-119777

HighCVSS 7.8

Published: 30/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

A flaw exists in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow.

Risk Assessment

An attacker could cause an application crash and potentially execute code in the context of the affected application. The risk affects systems processing untrusted media files.

Recommendation

Update GStreamer and gst-plugins-bad to a patched version and avoid processing untrusted H.266 files.

Other vulnerabilities in GStreamer gst-plugins-bad

CVE-2026-53701Medium
An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser. In the multi-slice-in-tile processing of gst_h266_parser_parse_picture_partition(), the loop iterates without checking that the slice index stays within bounds, leading to writes past three fixed-size arrays.

Original NVD description (English source)

A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow. An attacker could cause an application to crash and may be able to execute code in the context of the affected application.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS