{"id":"CVE-2026-119777","kind":"vulnerability","aliases":["CVE-2026-119777"],"related":[],"title":"GStreamer: malformed H.266 file can overflow stack and run code","description":"A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow. An attacker could cause an application to crash and may be able to execute code in the context of the affected application.","summary":"GStreamer's gst-plugins-bad H.266/VVC parser mishandles profile, tier and level fields in a malformed file or stream, causing an integer overflow that leads to a stack-based buffer overflow. An attacker may crash the application or run code in its context.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"gst-plugins-bad","fixed":["1.28.2"],"affected":">= 1.25.1, < 1.28.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["gst-plugins-bad","gstreamer","linux","media-pipeline","package"],"not_affected_if":["gst-plugins-bad-1.28.2-or-later","gstreamer-below-1.25.1","no-vvc-processing"],"how_to_check":"Run 'gst-inspect-1.0 --version' or your package manager (e.g. dpkg -l 'gstreamer1.0-plugins-bad', rpm -q gstreamer1-plugins-bad-free). Versions >= 1.25.1 and < 1.28.2 are affected. Check the vvc parser exists: gst-inspect-1.0 h266parse.","fix":"Upgrade gst-plugins-bad to 1.28.2 or later (distro packages: the build that backports the 1.28.2 fix); older versions must apply the patch and recompile.","status":"open","published_at":"2026-10-30T18:17:27+00:00","first_seen_at":"2026-10-30T18:55:29+00:00","triaged_at":"2026-10-30T18:56:39+00:00","updated_at":"2026-10-30T18:57:35+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T18:56:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"GStreamer: malformed H.266 file can overflow stack and run code","impact":"high","summary":"GStreamer's gst-plugins-bad H.266/VVC parser mishandles profile, tier and level fields in a malformed file or stream, causing an integer overflow that leads to a stack-based buffer overflow. An attacker may crash the application or run code in its context.","audience":"developers","category":"package","nicknames":[],"who_cares":["gstreamer","media-pipeline","linux"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"code runs in the context of the affected application","analyst_note":"Find the affected and fixed gst-plugins-bad versions and whether the NVD entry or upstream GStreamer advisory names a patch.","how_to_check":"- Check whether the GStreamer plugins-bad package is installed, for example with `gst-inspect-1.0 vvc` or your distribution's package manager.\n- Confirm whether your application decodes or parses H.266/VVC media.","plain_action":"","needs_analyst":true,"not_affected_if":["no-vvc-processing"],"who_is_affected":"Applications that use GStreamer's gst-plugins-bad to parse H.266/VVC media from untrusted sources are exposed. Systems that never process VVC content are unlikely to reach the vulnerable code. The sources do not list affected versions or a fix.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000683,"input_tokens":4132,"output_tokens":539,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed gst-plugins-bad versions and whether the NVD entry or upstream GStreamer advisory names a patch.","search":"'-119777':13A,16A '-2026':12A,15A 'abl':128C 'affect':137C 'applic':69B,122C,138C 'attack':65B,118C 'bad':20A,24B,36B,86C 'base':61B,114C 'buffer':62B,115C 'caus':51B,120C 'code':10A,72B,131C 'context':75B,134C 'could':119C 'crash':67B,124C 'cve':11A,14A 'execut':130C 'field':44B,107C 'file':4A,48B,95C 'flaw':77C 'found':79C 'gst':18A,22B,34B,84C 'gst-plugins-bad':17A,21B,33B,83C 'gstreamer':1A,25B,31B,81C 'h.266':3A,93C 'h.266/vvc':37B,87C 'integ':53B,99C 'lead':56B,109C 'level':43B,106C 'linux':26B 'malform':2A,47B,92C 'may':66B,126C 'media':28B,94C 'media-pipelin':27B 'mishandl':39B 'overflow':6A,54B,63B,100C,116C 'packag':30B 'pars':102C 'parser':38B,88C 'pipelin':29B 'plugin':23B,35B,85C 'plugins':19A 'process':90C 'profil':40B,103C 'run':9A,71B 'stack':7A,60B,113C 'stack-bas':59B,112C 'stream':50B,97C 'tier':41B,104C","nicknames":[],"mitigations":[],"who_affected":"Applications that use GStreamer's gst-plugins-bad to parse H.266/VVC media from untrusted sources are exposed. Systems that never process VVC content are unlikely to reach the vulnerable code. The sources do not list affected versions or a fix.","tier":"B","verified":{"fix":{"at":"2026-10-30T18:57:35Z","by":"analyst","doc":"https://gstreamer.freedesktop.org/security/sa-2026-0017.html","run_id":1183},"products":{"at":"2026-10-30T18:57:35Z","by":"analyst","doc":"https://gstreamer.freedesktop.org/security/sa-2026-0017.html","run_id":1183}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T18:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119777","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119777","severity":null,"published_at":"2026-10-30T18:17:27+00:00","modified_at":"2026-10-30T18:17:27+00:00","first_seen_at":"2026-10-30T18:55:29+00:00","fetched_at":"2026-10-30T18:55:29+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119777:1183","url":null,"severity":null,"published_at":"2026-10-30T18:57:35+00:00","modified_at":"2026-10-30T18:57:35+00:00","first_seen_at":"2026-10-30T18:57:35+00:00","fetched_at":"2026-10-30T18:57:35+00:00","note":"Upstream advisory GStreamer-SA-2026-0017 (2026-04-07) matches this description exactly (H.266/VVC profile/tier/level integer overflow -> stack overflow): affected gst-plugins-bad >= 1.25.1, < 1.28.2, fixed in 1.28.2. Caveat: that page says 'No CVE number assigned', so the match to CVE-2026-119777 is by description; Red Hat is the CNA. Distro backport versions not checked. No known exploitation or PoC found."}],"documents":[{"id":25335,"url":"https://gstreamer.freedesktop.org/security/sa-2026-0017.html","title":"GStreamer Security Advisory 2026-0017","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}