DEBIAN-CVE-2026-119777: Buffer Overflow
A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow. An attacker could cause an application to crash and may be able to execute code in the context of the affected application.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/gst-plugins-bad1.0to a version that resolves this vulnerability.Fixed in 1.28.2-1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Debian's gst-plugins-bad1.0 package that process H.266/VVC media files or streams are exposed. The vulnerability is triggered while parsing malformed H.266/VVC content.
What does an attacker need to exploit it?
An attacker needs to get a malformed H.266/VVC media file or stream processed by an affected application. The listed vector indicates network reachability, no required privileges, low attack complexity, and required user interaction.
What is the likely impact if exploitation succeeds?
The flaw can cause the affected application to crash. It may also allow code execution in the context of that application, with high potential impact to confidentiality, integrity, and availability.