{"id":"CVE-2026-119729","kind":"vulnerability","aliases":["CVE-2026-119729"],"related":[],"title":"GStreamer: malformed AV1 stream integer overflow crashes media applications","description":"A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker can cause integer overflow in the parser, resulting in incorrect length values being used during stream processing, which can lead to a denial of service.","summary":"GStreamer's AV1 LEB128 length parser has an integer overflow that a malformed AV1 bitstream can trigger. An attacker can crash any application that processes that media, causing denial of service.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["av1","gstreamer","media-processing","runtime"],"not_affected_if":["no-av1-content","trusted-input-only"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-30T19:18:21+00:00","first_seen_at":"2026-10-30T19:25:29+00:00","triaged_at":"2026-10-30T19:26:18+00:00","updated_at":"2026-10-30T19:26:18+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-30T19:26:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"GStreamer: malformed AV1 stream integer overflow crashes media applications","impact":"low","summary":"GStreamer's AV1 LEB128 length parser has an integer overflow that a malformed AV1 bitstream can trigger. An attacker can crash any application that processes that media, causing denial of service.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["gstreamer","media-processing","av1"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Application crashes, causing denial of service for media processing","analyst_note":"Sources give no affected or fixed versions; check the NVD entry and GStreamer upstream advisory for version ranges.","how_to_check":"- Check whether applications on your systems use GStreamer to decode AV1 media (look for the `gstreamer` packages and AV1 plugins installed).\n- Check the installed GStreamer version with `gst-inspect-1.0 --version`.","plain_action":"","needs_analyst":true,"not_affected_if":["no-av1-content","trusted-input-only"],"who_is_affected":"Applications that parse AV1 video or media files through GStreamer are exposed when they accept untrusted input, such as media uploaded or streamed from outside. Systems that never process AV1 content through GStreamer can skip it. The sources do not give affected version ranges.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000678,"input_tokens":4147,"output_tokens":527,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119729':12A,15A '-2026':11A,14A 'allow':72C 'applic':9A,44B,81C 'attack':40B,75C,101C 'av1':3A,16B,24B,35B,65C,84C,91C 'bitstream':36B,92C 'caus':49B,77C,103C 'contain':93C 'content':86C 'craft':88C 'crash':7A,42B,79C 'cve':10A,13A 'denial':50B,124C 'encod':98C 'flaw':54C 'found':56C 'gstreamer':1A,17B,22B,58C 'incorrect':111C 'integ':5A,30B,60C,70C,104C 'invalid':95C 'lead':121C 'leb128':25B,66C,97C 'leb128-encoded':96C 'length':26B,69C,112C 'malform':2A,34B,90C 'media':8A,19B,48B,85C 'media-process':18B 'overflow':6A,31B,61C,105C 'parser':27B,71C,108C 'process':20B,46B,83C,118C 'remot':74C 'result':109C 'runtim':21B 'servic':52B,126C 'stream':4A,117C 'trigger':38B 'use':115C 'valu':99C,113C 'variabl':68C 'variable-length':67C 'vulner':62C","nicknames":[],"mitigations":[],"who_affected":"Applications that parse AV1 video or media files through GStreamer are exposed when they accept untrusted input, such as media uploaded or streamed from outside. Systems that never process AV1 content through GStreamer can skip it. The sources do not give affected version ranges.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:18:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119729","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119729","severity":null,"published_at":"2026-10-30T19:18:21+00:00","modified_at":"2026-10-30T19:18:22+00:00","first_seen_at":"2026-10-30T19:25:29+00:00","fetched_at":"2026-10-30T19:25:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}