Live › vulnerability › CVE-2026-119729
GStreamer's AV1 LEB128 length parser has an integer overflow that a malformed AV1 bitstream can trigger. An attacker can crash any application that processes that media, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Applications that parse AV1 video or media files through GStreamer are exposed when they accept untrusted input, such as media uploaded or streamed from outside. Systems that never process AV1 content through GStreamer can skip it. The sources do not give affected version ranges.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker can cause integer overflow in the parser, resulting in incorrect length values being used during stream processing, which can lead to a denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-119729")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.