CVE-2026-121611: Gstreamer1-plugins-bad-free: gst-plugins-bad: use of uninitialized gsth265hrdparams in gst_h265_parse_vps() multi-hrd workaround loop

gst-plugins-bad (GstCodecparsers library) contains a use-of-uninitialized-variable (CWE-457) in gsth265parsevps() in gst-libs/gst/codecparsers/gsth265parser.c. When a VPS NAL unit declares more than one HRD parameter set (vpsnumhrdparameters >= 2), the workaround loop at lines 2152-2165 processes each extra set (i >= 1) into a local GstH265HRDParams hrdparams variable declared at line 2155 that is never zero-initialized before being passed to gsth265parsehrdparameters(). That function sets only three fields to defaults and leaves all other fields as stack garbage, which steers further parsing (including gsth265parsesublayerhrdparameters() at line 439). Bug introduced in upstream GStreamer 1.16.0 (commit 52f2054386). Fix targeted for upstream 1.28.9 (not yet merged as of 2026-10-30; private gstreamer-security MR !132). GStreamer security advisory SA-2026-0094. PSIRT support ticket PSIRTSUPT-29600. Reporter: Sebastian Dröge, Centricular Ltd.

— Red Hat