UBUNTU-CVE-2026-121611: Medium severity ubuntu/gst-plugins-bad1.0 vulnerability
A flaw was found in GStreamer's gst-plugins-bad package. A use of uninitialized memory vulnerability exists in the H.265 (HEVC) bitstream parser when processing Video Parameter Sets that declare more than one HRD (Hypothetical Reference Decoder) parameter set. A remote attacker could exploit this by providing a crafted H.265 media file or stream that, when processed by an application using GStreamer, causes unpredictable parser behavior and may crash the application. This can lead to a denial of service for any application using GStreamer to play back H.265 content.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications that use GStreamer with the gst-plugins-bad package to process H.265 (HEVC) media are exposed. The described impact is a crash or other unpredictable parser behavior when handling malicious content.
What does an attacker need to exploit it?
An attacker needs to provide a crafted H.265 media file or stream containing a Video Parameter Set that declares more than one HRD parameter set. The vulnerable application must process that content through the affected GStreamer parser.
Is this a remote denial-of-service risk?
Yes, when an application accepts or plays attacker-supplied H.265 files or streams remotely. Successful exploitation may crash the application, resulting in denial of service.