gst-plugins-bad: Stack-based buffer overflow in H.266/VVC parser
Summary
The H.266/VVC parser in GStreamer's gst-plugins-bad library contains a stack-based buffer overflow (CWE-787). An integer overflow while parsing profile, tier and level fields can be triggered by a malformed H.266/VVC media file or stream. An attacker can crash a GStreamer-based application and may be able to execute code with the application's privileges, although code execution has not been demonstrated. Exploitation requires a user or service to open or ingest the attacker-controlled file or stream.
Affected
- Red Hat Enterprise Linux 10: gstreamer1-plugins-bad-free in RHEL 10.2.z, 10.3.z and 10.4 (per the Red Hat CVE record)
- Red Hat RHIVOS 2.1 and 2.1-core
- Fedora 43, including the MinGW package
- RHEL 7, 8 and 9 and RHEL 10.0: not affected per Red Hat (versions predate the vulnerable code)
- Fedora 44 and Rawhide: not affected per Red Hat (vulnerable code no longer present)
- Other distributions and upstream GStreamer releases: unknown
Fixed in
Unknown.
Workaround
- No complete mitigation is available.
- Disable H.266/VVC media ingestion in GStreamer-based applications and media pipelines where it is not required.
- Do not open or transcode H.266/VVC files or streams from untrusted sources until a fixed package is available.
Exploitation
- No known exploitation in the wild.
- Not listed in CISA KEV (per one aggregator).
- CISA SSVC: exploitation none, automatable no, technical impact total.
- EPSS: 0.19 % (30 Oct 2026).
Our recommendation
- Inventory Linux systems and applications that have gstreamer1-plugins-bad or gst-plugins-bad installed.
- Apply the vendor update for your distribution as soon as it is available and check the Red Hat advisory for the fixed package version.
- Until patched, avoid opening H.266/VVC media from untrusted sources and disable the H.266 plugin where it is not needed.
- Re-check NVD and CISA KEV for analysis or exploitation changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE page CVE-2026-119777 access.redhat.com
- Red Hat Bugzilla 2564164 bugzilla.redhat.com
- Upstream GStreamer merge request 11241 gitlab.freedesktop.org
- Offseq threat radar entry (aggregator) radar.offseq.com
- Positive Technologies PT-2026-133729 (Vulners) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:41.
Original description (NVD)
A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow. An attacker could cause an application to crash and may be able to execute code in the context of the affected application.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.