Bug 2564118 (CVE-2026-119727)

Summary: CVE-2026-119727 gst-plugins-bad: gst-plugins-bad: H.265 SPS SCC palette predictor array overflow via integer underflow in bounds computation
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the parser to accept an out-of-range value for the number of palette predictor entries. This causes the parser to write beyond the end of a fixed-size array, resulting in memory corruption and an application crash. Successful exploitation requires an attacker to provide a malformed H.265 media file to a vulnerable application, and is limited to a denial-of-service impact.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-30 15:07:48 UTC 
GStreamer's gst-plugins-bad provides the H.265 (HEVC) bitstream parser in subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gsth265parser.c. In the function gst_h265_parse_sps_ext() at approximately line 2297, when parsing the SPS SCC (Screen Content Coding) extension, the code computes the upper bound for sps_num_palette_predictor_initializer_minus1 as 'palette_max_size + delta_palette_max_predictor_size - 1'. If an attacker crafts a bitstream where both palette_max_size and delta_palette_max_predictor_size are 0 (legal values per their individual READ_UE_MAX constraints), this subtraction produces 0xFFFFFFFF via unsigned integer underflow. The READ_UE_MAX macro checks 'val > max' using guint32 comparison, so 0xFFFFFFFF as max accepts any guint32 value. The field sps_num_palette_predictor_initializer_minus1 is stored in a guint8, so the value is truncated to 0..255. If the truncated value exceeds 127, the subsequent loop 'for (i = 0; i < num; i++) READ_UINT32(nr, sps_palette_predictor_initializer[comp][i], num_bits)' writes past the end of the guint32 sps_palette_predictor_initializer[3][128] array, causing a heap buffer overflow into adjacent GstH265SPSSCCExtensionParams and GstH265SPS struct members. This corrupts the GstH265SPS object stored in the parser's static sps[] array.

Affected versions: gst-plugins-bad < 1.28.1.
Fix: gst-plugins-bad 1.28.1 adds a guard 'if (palette_max_size + delta_palette_max_predictor_size == 0) goto error' before the bound computation.
Advisory: GStreamer-SA-2026-0012.
Reporter: GStreamer project (upstream self-reported).