Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

gst-plugins-bad (GstCodecparsers library) contains a use-of-uninitialized-variable (CWE-457) in gst_h265_parse_vps() in gst-libs/gst/codecparsers/gsth265parser.c. When a VPS NAL unit declares more than one HRD parameter set (vps_num_hrd_parameters >= 2), the workaround loop at lines 2152-2165 processes each extra set (i >= 1) into a local GstH265HRDParams hrd_params variable declared at line 2155 that is never zero-initialized before being passed to gst_h265_parse_hrd_parameters(). That function sets only three fields to defaults and leaves all other fields as stack garbage, which steers further parsing (including gst_h265_parse_sub_layer_hrd_parameters() at line 439). Bug introduced in upstream GStreamer 1.16.0 (commit 52f2054386). Fix targeted for upstream 1.28.9 (not yet merged as of 2026-10-30; private gstreamer-security MR !132). GStreamer security advisory SA-2026-0094. PSIRT support ticket PSIRTSUPT-29600. Reporter: Sebastian Dröge, Centricular Ltd.