CVE-2026-119729: Gst-plugins-base: gst-plugins-bad: gst-plugins-base/gst-plugins-bad: integer overflow in av1 leb128 parser allows denial of service

Q: What must an attacker provide to trigger the issue?

The attacker must cause an application to process a crafted AV1 media bitstream containing an invalid LEB128-encoded value. No attacker privileges are required, but user interaction is required.

Q: Which systems and applications are exposed?

Applications using the affected GStreamer components that process AV1 media content are exposed. The listed software packages are gst-plugins-bad1.0 and gst-plugins-base1.0 for Ubuntu and Debian.

Q: What is the expected impact of successful exploitation?

Successful exploitation can crash the application processing the malicious stream, causing a denial of service. The provided information does not indicate confidentiality or integrity impact.

Published Oct 30, 2026

Updated

A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker can cause integer overflow in the parser, resulting in incorrect length values being used during stream processing, which can lead to a denial of service.

Affected Software

19 affected componentsFixes available

debian/gst-plugins-bad1.0*

debian/gst-plugins-bad1.0<1.28.2-1

1.28.2-1

debian/gst-plugins-base1.0*

debian/gst-plugins-base1.0<1.28.2-1

1.28.2-1

debian/gst-plugins-bad1.0<=1.22.0-4+deb12u7, <=1.22.0-4+deb12u8, <=1.26.2-3+deb13u3

1.28.8-1

debian/gst-plugins-base1.0<=1.22.0-3+deb12u6, <=1.22.0-3+deb12u7, <=1.26.2-1+deb13u1, <=1.26.2-1+deb13u2

1.28.8-1

ubuntu/gst-plugins-bad1.0*

ubuntu/gst-plugins-base1.0*

ubuntu/gst-plugins-bad1.0*

ubuntu/gst-plugins-base1.0*

ubuntu/gst-plugins-bad1.0*

ubuntu/gst-plugins-base1.0*

ubuntu/gst-plugins-bad1.0*

ubuntu/gst-plugins-base1.0*

ubuntu/gst-plugins-bad1.0*

ubuntu/gst-plugins-base1.0*

ubuntu/gst-plugins-bad1.0*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/gst-plugins-bad1.0 to a version that resolves this vulnerability.
Fixed in 1.28.2-1
Upgrade
Upgrade debian/gst-plugins-base1.0 to a version that resolves this vulnerability.
Fixed in 1.28.2-1
Upgrade
Upgrade debian/gst-plugins-bad1.0 to a version that resolves this vulnerability.
Fixed in 1.28.8-1
Upgrade
Upgrade debian/gst-plugins-base1.0 to a version that resolves this vulnerability.
Fixed in 1.28.8-1

Event History

Oct 30, 2026

CVE Published

via MITRE·06:34 PM

Data Sourced

via MITRE·06:34 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:18 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·07:18 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What must an attacker provide to trigger the issue?

The attacker must cause an application to process a crafted AV1 media bitstream containing an invalid LEB128-encoded value. No attacker privileges are required, but user interaction is required.

Which systems and applications are exposed?

Applications using the affected GStreamer components that process AV1 media content are exposed. The listed software packages are gst-plugins-bad1.0 and gst-plugins-base1.0 for Ubuntu and Debian.

What is the expected impact of successful exploitation?

Successful exploitation can crash the application processing the malicious stream, causing a denial of service. The provided information does not indicate confidentiality or integrity impact.

CVE-2026-119729: Gst-plugins-base: gst-plugins-bad: gst-plugins-base/gst-plugins-bad: integer overflow in av1 leb128 parser allows denial of service

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker provide to trigger the issue?

Which systems and applications are exposed?

What is the expected impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker provide to trigger the issue?

Which systems and applications are exposed?

What is the expected impact of successful exploitation?