MEDIUM 6.5 NVD
CVE-2026-121611
A flaw was found in GStreamer's gst-plugins-bad package. A use of uninitialized memory vulnerability exists in the H.265 (HEVC) bitstream parser when processing
A flaw was found in GStreamer's gst-plugins-bad package. A use of uninitialized memory vulnerability exists in the H.265 (HEVC) bitstream parser when processing Video Parameter Sets that declare more than one HRD (Hypothetical Reference Decoder) parameter set. A remote attacker could exploit this by providing a crafted H.265 media file or stream that, when processed by an application using GStreamer, causes unpredictable parser behavior and may crash the application. This can lead to a denial of service for any application using GStreamer to play back H.265 content.
References
- https://access.redhat.com/security/cve/CVE-2026-121611
- https://bugzilla.redhat.com/show_bug.cgi?id=2565937
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5332
- https://gstreamer.freedesktop.org/security/sa-2026-0094.html
This medium severity vulnerability with a CVSS score of 6.5 was published on 2026-11-09 via NVD.
vulnfeed aggregates 17092 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.