Bug 2565937 (CVE-2026-121611) - CVE-2026-121611 gstreamer1-plugins-bad-free: gst-plugins-bad: use of uninitialized GstH265HRDParams in gst_h265_parse_vps() multi-HRD workaround loop
Summary: CVE-2026-121611 gstreamer1-plugins-bad-free: gst-plugins-bad: use of uninitia...
Keywords:
Status: NEW
Alias: CVE-2026-121611
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2569065 2569067 2569069 2569071 2569073 2569074 2569083 2569084
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-11-03 16:36 UTC by OSIDB Bzimport
Modified: 2026-11-09 11:13 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-11-03 16:36:19 UTC 
gst-plugins-bad (GstCodecparsers library) contains a use-of-uninitialized-variable (CWE-457) in gst_h265_parse_vps() in gst-libs/gst/codecparsers/gsth265parser.c. When a VPS NAL unit declares more than one HRD parameter set (vps_num_hrd_parameters >= 2), the workaround loop at lines 2152-2165 processes each extra set (i >= 1) into a local GstH265HRDParams hrd_params variable declared at line 2155 that is never zero-initialized before being passed to gst_h265_parse_hrd_parameters(). That function sets only three fields to defaults and leaves all other fields as stack garbage, which steers further parsing (including gst_h265_parse_sub_layer_hrd_parameters() at line 439). Bug introduced in upstream GStreamer 1.16.0 (commit 52f2054386). Fix targeted for upstream 1.28.9 (not yet merged as of 2026-10-30; private gstreamer-security MR !132). GStreamer security advisory SA-2026-0094. PSIRT support ticket PSIRTSUPT-29600. Reporter: Sebastian Dröge, Centricular Ltd.
Note You need to log in before you can comment on or make changes to this bug.