{"id":"CVE-2026-119727","kind":"vulnerability","aliases":["CVE-2026-119727"],"related":[],"title":"GStreamer gst-plugins-bad: crafted H.265 video file crashes media-playing applications","description":"A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the parser to accept an out-of-range value for the number of palette predictor entries. This causes the parser to write beyond the end of a fixed-size array, resulting in memory corruption and an application crash. Successful exploitation requires an attacker to provide a malformed H.265 media file to a vulnerable application, and is limited to a denial-of-service impact.","summary":"A malformed H.265 video file can make GStreamer's H.265 parser write past the end of a fixed-size array during parsing. The result is memory corruption and an application crash, and the sources limit the impact to denial of service.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gstreamer","h265","linux","media-playback","package"],"not_affected_if":["no-untrusted-h265-input"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-30T19:18:21+00:00","first_seen_at":"2026-10-30T19:25:28+00:00","triaged_at":"2026-10-30T19:26:19+00:00","updated_at":"2026-10-30T19:26:19+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T19:26:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"GStreamer gst-plugins-bad: crafted H.265 video file crashes media-playing applications","impact":"low","summary":"A malformed H.265 video file can make GStreamer's H.265 parser write past the end of a fixed-size array during parsing. The result is memory corruption and an application crash, and the sources limit the impact to denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["gstreamer","h265","media-playback","linux"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Application crashes when it parses a crafted H.265 file","analyst_note":"Find the affected and fixed gst-plugins-bad versions in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-119727) or the upstream GStreamer advisory.","how_to_check":"- Check whether the GStreamer H.265 parser from gst-plugins-bad is installed, for example with `gst-inspect-1.0 h265parse`\n- unknown for the exact vulnerable version range; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["no-untrusted-h265-input"],"who_is_affected":"Applications that use GStreamer's gst-plugins-bad H.265 parser to open video files, which can be triggered when such an application is given an attacker-supplied H.265 file. The sources do not give affected version ranges or a fix. Systems that never parse untrusted H.265 media through GStreamer can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000713,"input_tokens":4226,"output_tokens":581,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119727':17A,20A '-2026':16A,19A 'accept':117C 'allow':113C 'applic':14A,58B,152C,169C 'array':48B,145C 'attack':158C 'bad':5A,80C 'beyond':137C 'bitstream':90C 'bound':111C 'caus':132C 'certain':99C 'code':95C 'comput':112C 'contain':91C 'content':94C 'corrupt':55B,149C 'craft':6A,88C 'crash':10A,59B,153C 'cve':15A,18A 'denial':67B,176C 'denial-of-servic':175C 'end':42B,139C 'entri':130C 'exploit':155C 'extens':97C 'file':9A,32B,165C 'fix':46B,143C 'fixed-s':45B,142C 'flaw':71C 'found':73C 'gst':3A,78C 'gst-plugins-bad':2A,77C 'gstreamer':1A,21B,35B,75C 'h.265':7A,30B,37B,81C,89C,163C 'h265':22B 'impact':65B,179C 'initi':102C 'integ':105C 'limit':63B,172C 'linux':23B 'make':34B 'malform':29B,162C 'media':12A,25B,164C 'media-play':11A 'media-playback':24B 'memori':54B,148C 'number':126C 'out-of-rang':119C 'packag':27B 'palett':100C,128C 'pars':50B,85C 'parser':38B,83C,115C,134C 'past':40B 'play':13A 'playback':26B 'plugin':4A,79C 'predictor':101C,129C 'provid':160C 'rang':122C 'requir':156C 'result':52B,146C 'scc':96C 'screen':93C 'servic':69B,178C 'set':103C 'size':47B,144C 'sourc':62B 'special':87C 'success':154C 'underflow':106C 'upper':110C 'upper-bound':109C 'valu':123C 'video':8A,31B,82C 'vulner':168C 'write':39B,136C","nicknames":[],"mitigations":[],"who_affected":"Applications that use GStreamer's gst-plugins-bad H.265 parser to open video files, which can be triggered when such an application is given an attacker-supplied H.265 file. The sources do not give affected version ranges or a fix. Systems that never parse untrusted H.265 media through GStreamer can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T19:18:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119727","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119727","severity":null,"published_at":"2026-10-30T19:18:21+00:00","modified_at":"2026-10-30T19:18:21+00:00","first_seen_at":"2026-10-30T19:25:28+00:00","fetched_at":"2026-10-30T19:25:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}