UBUNTU-CVE-2026-119777: Buffer Overflow
A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow. An attacker could cause an application to crash and may be able to execute code in the context of the affected application.
Affected Software
Event History
Frequently Asked Questions
Which systems are most exposed to this issue?
Systems are exposed if they use Ubuntu's gst-plugins-bad1.0 package in an application that processes H.266/VVC media files or streams. The vulnerable component is the H.266/VVC parser.
What must an attacker do to exploit it?
An attacker needs to get a malformed H.266/VVC media file or stream processed by an affected application. The supplied vector indicates local access and user interaction are required.
What is the likely impact if exploitation succeeds?
The affected application can crash because of a stack-based buffer overflow. The issue may also allow code execution in the context of that application, with confidentiality, integrity, and availability impact.