{"id":"CVE-2026-121611","kind":"vulnerability","aliases":["CVE-2026-121611"],"related":[],"title":"GStreamer: crafted H.265 file can crash media apps via uninitialized memory","description":"A flaw was found in GStreamer's gst-plugins-bad package. A use of uninitialized memory vulnerability exists in the H.265 (HEVC) bitstream parser when processing Video Parameter Sets that declare more than one HRD (Hypothetical Reference Decoder) parameter set. A remote attacker could exploit this by providing a crafted H.265 media file or stream that, when processed by an application using GStreamer, causes unpredictable parser behavior and may crash the application. This can lead to a denial of service for any application using GStreamer to play back H.265 content.","summary":"A flaw in GStreamer's gst-plugins-bad H.265 (HEVC) parser reads uninitialized memory when a video parameter set declares more than one HRD parameter set. A crafted H.265 file or stream can make parsing behave unpredictably and crash any application using GStreamer to play it, causing denial of service.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gst-plugins-bad","gstreamer","h265","media-playback","package"],"not_affected_if":["no-h265-input"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-09T13:17:07+00:00","first_seen_at":"2026-11-09T13:26:50+00:00","triaged_at":"2026-11-09T13:27:39+00:00","updated_at":"2026-11-09T13:27:39+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T13:27:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"GStreamer: crafted H.265 file can crash media apps via uninitialized memory","impact":"low","summary":"A flaw in GStreamer's gst-plugins-bad H.265 (HEVC) parser reads uninitialized memory when a video parameter set declares more than one HRD parameter set. A crafted H.265 file or stream can make parsing behave unpredictably and crash any application using GStreamer to play it, causing denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["gstreamer","gst-plugins-bad","h265","media-playback"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"application crashes, causing denial of service","analyst_note":"Find affected and fixed gst-plugins-bad versions and any upstream advisory; NVD entry alone lists no product ranges.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-h265-input"],"who_is_affected":"Applications that use GStreamer's gst-plugins-bad H.265 parser to decode video, including media players and apps that accept H.265 uploads or streams from untrusted sources. Applications that never parse H.265 input, or that only handle trusted media, are less exposed. The sources do not list affected or fixed versions.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000719,"input_tokens":4628,"output_tokens":512,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121611':14A,17A '-2026':13A,16A 'app':8A 'applic':69B,140C,151C,162C 'attack':122C 'back':167C 'bad':21B,36B,89C 'behav':64B 'behavior':146C 'bitstream':102C 'caus':75B,143C 'content':169C 'could':123C 'craft':2A,56B,129C 'crash':6A,67B,149C 'cve':12A,15A 'declar':48B,110C 'decod':117C 'denial':76B,157C 'exist':97C 'exploit':124C 'file':4A,58B,132C 'flaw':29B,80C 'found':82C 'gst':19B,34B,87C 'gst-plugins-bad':18B,33B,86C 'gstreamer':1A,22B,31B,71B,84C,142C,164C 'h.265':3A,37B,57B,100C,130C,168C 'h265':23B 'hevc':38B,101C 'hrd':52B,114C 'hypothet':115C 'lead':154C 'make':62B 'may':148C 'media':7A,25B,131C 'media-playback':24B 'memori':11A,42B,95C 'one':51B,113C 'packag':27B,90C 'paramet':46B,53B,107C,118C 'pars':63B 'parser':39B,103C,145C 'play':73B,166C 'playback':26B 'plugin':20B,35B,88C 'process':105C,137C 'provid':127C 'read':40B 'refer':116C 'remot':121C 'servic':78B,159C 'set':47B,54B,108C,119C 'stream':60B,134C 'uniniti':10A,41B,94C 'unpredict':65B,144C 'use':70B,92C,141C,163C 'via':9A 'video':45B,106C 'vulner':96C","nicknames":[],"mitigations":[],"who_affected":"Applications that use GStreamer's gst-plugins-bad H.265 parser to decode video, including media players and apps that accept H.265 uploads or streams from untrusted sources. Applications that never parse H.265 input, or that only handle trusted media, are less exposed. The sources do not list affected or fixed versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gstpluginsbad","gstreamer","h265","mediaplayback","medium","package"],"campaign_type":null,"search_a":"'-121611':14A,17A '-2026':13A,16A 'app':8A 'craft':2A 'crash':6A 'cve':12A,15A 'file':4A 'gstreamer':1A 'h.265':3A 'media':7A 'memori':11A 'uniniti':10A 'via':9A","search_b":"'applic':69B 'bad':21B,36B 'behav':64B 'caus':75B 'craft':56B 'crash':67B 'declar':48B 'denial':76B 'file':58B 'flaw':29B 'gst':19B,34B 'gst-plugins-bad':18B,33B 'gstreamer':22B,31B,71B 'h.265':37B,57B 'h265':23B 'hevc':38B 'hrd':52B 'make':62B 'media':25B 'media-playback':24B 'memori':42B 'one':51B 'packag':27B 'paramet':46B,53B 'pars':63B 'parser':39B 'play':73B 'playback':26B 'plugin':20B,35B 'read':40B 'servic':78B 'set':47B,54B 'stream':60B 'uniniti':41B 'unpredict':65B 'use':70B 'video':45B","search_c":"'applic':140C,151C,162C 'attack':122C 'back':167C 'bad':89C 'behavior':146C 'bitstream':102C 'caus':143C 'content':169C 'could':123C 'craft':129C 'crash':149C 'declar':110C 'decod':117C 'denial':157C 'exist':97C 'exploit':124C 'file':132C 'flaw':80C 'found':82C 'gst':87C 'gst-plugins-bad':86C 'gstreamer':84C,142C,164C 'h.265':100C,130C,168C 'hevc':101C 'hrd':114C 'hypothet':115C 'lead':154C 'may':148C 'media':131C 'memori':95C 'one':113C 'packag':90C 'paramet':107C,118C 'parser':103C,145C 'play':166C 'plugin':88C 'process':105C,137C 'provid':127C 'refer':116C 'remot':121C 'servic':159C 'set':108C,119C 'stream':134C 'uniniti':94C 'unpredict':144C 'use':92C,141C,163C 'video':106C 'vulner':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T13:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121611","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121611","severity":null,"published_at":"2026-11-09T13:17:07+00:00","modified_at":"2026-11-09T13:17:07+00:00","first_seen_at":"2026-11-09T13:26:50+00:00","fetched_at":"2026-11-09T13:26:50+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}