CVE-2026-119777High· 8.8▾ TwilightA flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow. An att…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.5%
A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow. An attacker could cause an application to crash and may be able to execute code in the context of the affected application.
gstreamer1-plugins-bad-free (all versions)gstreamer1-plugins-bad-freegstreamer1-plugins-bad-freegstreamer1-plugins-bad-freeRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
There is no complete mitigation for this vulnerability. As a risk-reduction measure, disable H.266/VVC media ingestion in GStreamer-based applications and media pipelines where that feature is not required. Until a fixed package is available, do not open or transcode H.266/VVC files or streams from untrusted sources.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-53702Medium· 6.5Gstreamer1-plugins-bad-free: gstreamer: stack buffer overflow in h.265 buffering period sei parser
CVE-2026-53701Medium· 6.5Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds write in h.266/vvc pps picture partition parser
CVE-2026-19387High· 7.6A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio
CVE-2026-59691High· 7.1A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin
CVE-2026-52721Medium· 5.3Gstreamer1-plugins-bad-free: gstreamer: multiple out-of-bounds reads in pcapparse ipv4/tcp header parsing
CVE-2026-121259Medium· 6.5Gst-plugins-bad: gst-plugins-bad: integer overflows and division by zero in jpeg 2000 decimator