Bug 2564164 (CVE-2026-119777)

Summary:	CVE-2026-119777 gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: stack buffer overflow in H.266/VVC parser
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow. An attacker could cause an application to crash and may be able to execute code in the context of the affected application.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2565682, 2565683
Bug Blocks:

Description OSIDB Bzimport 2026-10-30 16:21:17 UTC

GStreamer Security Advisory GStreamer-SA-2026-0017 reports an integer overflow in the gst-plugins-bad H.266/VVC parser while parsing profile, tier, and level fields from malformed H.266 streams. The resulting stack-based buffer overflow may crash an application processing malicious media and could possibly allow code execution. Upstream lists gst-plugins-bad versions 1.25.1 through versions before 1.28.2 as affected; version 1.28.2 contains the fix. The local verification report confirmed the code pattern by static analysis but did not confirm the exact exploit path.