CVE-2026-119727

A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the parser to accept an out-of-range value for the number of palette predictor entries. This causes the parser to write beyond the end of a fixed-size array, resulting in memory corruption and an application crash. Successful exploitation requires an attacker to provide a malformed H.265 media file to a vulnerable application, and is limited to a denial-of-service impact.

This vulnerability is rated as Moderate severity because exploitation causes a denial of service (application crash) when a user or process opens a crafted H.265 file; no confidentiality or integrity impact has been demonstrated. The vulnerable code path requires H.265 SCC palette mode with predictor initializers present, which is uncommon in typical consumer video and needs a deliberately malformed bitstream.

Red Hat Enterprise Linux 7 and RHEL 8 ship gstreamer1-plugins-bad-free based on upstream GStreamer 1.10.x and 1.16.x respectively. Those upstream versions do not include the H.265 SCC palette predictor initializer parsing added in later GStreamer releases, so RHEL 7 and RHEL 8 are not affected.

RHEL 9, RHEL 10, and Red Hat In-Vehicle OS ship gstreamer1-plugins-bad-free versions below upstream fix 1.28.1 and are affected. Fedora 44 and Fedora rawhide ship versions that include the fix. Fedora 43 remains affected.

SELinux confinement of the media application may limit impact after a crash in confined deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.