UBUNTU-CVE-2026-119727: Medium severity ubuntu/gst-plugins-bad1.0 vulnerability
A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the parser to accept an out-of-range value for the number of palette predictor entries. This causes the parser to write beyond the end of a fixed-size array, resulting in memory corruption and an application crash. Successful exploitation requires an attacker to provide a malformed H.265 media file to a vulnerable application, and is limited to a denial-of-service impact.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Ubuntu's gst-plugins-bad1.0 H.265 parser are exposed when they process attacker-supplied H.265 media files. Exploitation requires user interaction, consistent with the UI:R vector.
What does an attacker need to do to trigger the flaw?
An attacker must provide a specially crafted H.265 bitstream containing a Screen Content Coding extension with particular palette predictor initializer settings. No privileges are required.
What is the expected impact if exploitation succeeds?
The out-of-bounds write causes memory corruption and can crash the vulnerable application. The documented impact is limited to denial of service; confidentiality and integrity impacts are not indicated.