CVE-2026-121611 · Package
NO FIX YET
A flaw in GStreamer's gst-plugins-bad H.265 (HEVC) parser reads uninitialized memory when a video parameter set declares more than one HRD parameter set. A crafted H.265 file or stream can make parsing behave unpredictably and crash any application using GStreamer to play it, causing denial of service.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use GStreamer's gst-plugins-bad H.265 parser to decode video, including media players and apps that accept H.265 uploads or streams from untrusted sources. Applications that never parse H.265 input, or that only handle trusted media, are less exposed. The sources do not list affected or fixed versions.
Not affected if no-h265-input
Who cares gst-plugins-bad, gstreamer, h265, media-playback
Unknown from the sources.
No fix yet, per the sources.
A flaw was found in GStreamer's gst-plugins-bad package. A use of uninitialized memory vulnerability exists in the H.265 (HEVC) bitstream parser when processing Video Parameter Sets that declare more than one HRD (Hypothetical Reference Decoder) parameter set. A remote attacker could exploit this by providing a crafted H.265 media file or stream that, when processed by an application using GStreamer, causes unpredictable parser behavior and may crash the application. This can lead to a denial of service for any application using GStreamer to play back H.265 content.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.