Bug 2569067

Summary: CVE-2026-121611 gstreamer1-plugins-bad-free: gst-plugins-bad: use of uninitialized GstH265HRDParams in gst_h265_parse_vps() multi-HRD workaround loop [fedora-43]
Product: [Fedora] Fedora Reporter: lcelant
Component: gstreamer1-plugins-bad-freeAssignee: Yaakov Selkowitz <yselkowi>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: 43CC: dominik, gwync, multimedia-sig, negativo17, wtaymans, yselkowi
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["af4188d2-5317-4403-9e68-965743ea169a"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2565937    

Description lcelant 2026-11-09 11:04:25 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

gst-plugins-bad (GstCodecparsers library) contains a use-of-uninitialized-variable (CWE-457) in gst_h265_parse_vps() in gst-libs/gst/codecparsers/gsth265parser.c. When a VPS NAL unit declares more than one HRD parameter set (vps_num_hrd_parameters >= 2), the workaround loop at lines 2152-2165 processes each extra set (i >= 1) into a local GstH265HRDParams hrd_params variable declared at line 2155 that is never zero-initialized before being passed to gst_h265_parse_hrd_parameters(). That function sets only three fields to defaults and leaves all other fields as stack garbage, which steers further parsing (including gst_h265_parse_sub_layer_hrd_parameters() at line 439). Bug introduced in upstream GStreamer 1.16.0 (commit 52f2054386). Fix targeted for upstream 1.28.9 (not yet merged as of 2026-10-30; private gstreamer-security MR !132). GStreamer security advisory SA-2026-0094. PSIRT support ticket PSIRTSUPT-29600. Reporter: Sebastian Dröge, Centricular Ltd.