CVE-2026-119777: Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: stack buffer overflow in h.266/vvc parser

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-30 · updated 2026-10-30
Weakness: CWE-787

Description

A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow. An attacker could cause an application to crash and may be able to execute code in the context of the affected application.

Affected products

Red Hat Enterprise Linux 10: all versions

References

https://access.redhat.com/security/cve/CVE-2026-119777
https://bugzilla.redhat.com/show_bug.cgi?id=2564164
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11241

Get alerted when CVE-2026-119777 or the next vulnerability affects your stack