CVE-2026-119727Medium· 6.5▾ SunlitA flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer under…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the parser to accept an out-of-range value for the number of palette predictor entries. This causes the parser to write beyond the end of a fixed-size array, resulting in memory corruption and an application crash. An attacker can deliver the malformed bitstream as a local file or over a network stream such as HTTP, HLS, DASH, RTSP, RTP, or WebRTC. Successful exploitation requires the application to open or play that content, and is limited to a denial-of-service impact.
gstreamer1-plugins-bad-free (all versions)gstreamer1-plugins-bad-freegstreamer1-plugins-bad-freegstreamer1-plugins-bad-free (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-52720High· 8.8A heap buffer overflow vulnerability was found in GStreamer's librfb (RFB/VNC client)
CVE-2026-53702Medium· 6.5Gstreamer1-plugins-bad-free: gstreamer: stack buffer overflow in h.265 buffering period sei parser
CVE-2026-53701Medium· 6.5Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds write in h.266/vvc pps picture partition parser
CVE-2026-52721Medium· 5.3Gstreamer1-plugins-bad-free: gstreamer: multiple out-of-bounds reads in pcapparse ipv4/tcp header parsing
CVE-2026-121259Medium· 6.5Gst-plugins-bad: gst-plugins-bad: integer overflows and division by zero in jpeg 2000 decimator
CVE-2026-121997High· 8.1Gdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via qtdpsrc declared/actual length mismatch