CVE-2026-119727: Gst-plugins-bad: gst-plugins-bad: h.265 sps scc palette predictor array overflow via integer underflow in bounds computation
A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the parser to accept an out-of-range value for the number of palette predictor entries. This causes the parser to write beyond the end of a fixed-size array, resulting in memory corruption and an application crash. Successful exploitation requires an attacker to provide a malformed H.265 media file to a vulnerable application, and is limited to a denial-of-service impact.
Other sources
GStreamer's gst-plugins-bad provides the H.265 (HEVC) bitstream parser in subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gsth265parser.c. In the function gsth265parsespsext() at approximately line 2297, when parsing the SPS SCC (Screen Content Coding) extension, the code computes the upper bound for spsnumpalettepredictorinitializerminus1 as 'palettemaxsize + deltapalettemaxpredictorsize - 1'. If an attacker crafts a bitstream where both palettemaxsize and deltapalettemaxpredictorsize are 0 (legal values per their individual READUEMAX constraints), this subtraction produces 0xFFFFFFFF via unsigned integer underflow. The READUEMAX macro checks 'val > max' using guint32 comparison, so 0xFFFFFFFF as max accepts any guint32 value. The field spsnumpalettepredictorinitializerminus1 is stored in a guint8, so the value is truncated to 0..255. If the truncated value exceeds 127, the subsequent loop 'for (i = 0; i < num; i++) READUINT32(nr, spspalettepredictorinitializer[comp][i], numbits)' writes past the end of the guint32 spspalettepredictorinitializer[3][128] array, causing a heap buffer overflow into adjacent GstH265SPSSCCExtensionParams and GstH265SPS struct members. This corrupts the GstH265SPS object stored in the parser's static sps[] array.
Affected versions: gst-plugins-bad < 1.28.1. Fix: gst-plugins-bad 1.28.1 adds a guard 'if (palettemaxsize + deltapalettemaxpredictorsize == 0) goto error' before the bound computation. Advisory: GStreamer-SA-2026-0012. Reporter: GStreamer project (upstream self-reported).
— Red Hat