Live › vulnerability › CVE-2026-119777
GStreamer's gst-plugins-bad H.266/VVC parser mishandles profile, tier and level fields in a malformed file or stream, causing an integer overflow that leads to a stack-based buffer overflow. An attacker may crash the application or run code in its context.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:55 UTC. All times on this page are UTC.
Applications that use GStreamer's gst-plugins-bad to parse H.266/VVC media from untrusted sources are exposed. Systems that never process VVC content are unlikely to reach the vulnerable code. The sources do not list affected versions or a fix.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| gst-plugins-bad | vendor | >= 1.25.1, < 1.28.2 | 1.28.2 |
gst-inspect-1.0 --version or your package manager (e.g. dpkg -l gstreamer1.0-plugins-bad, rpm -q gstreamer1-plugins-bad-free)1.25.1 and < 1.28.2 are affectedUpgrade gst-plugins-bad to 1.28.2 or later (distro packages: the build that backports the 1.28.2 fix); older versions must apply the patch and recompile.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow. An attacker could cause an application to crash and may be able to execute code in the context of the affected application.
This page as .md · .json · in your agent: get_signal("CVE-2026-119777")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.