CVE-2026-119729

A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker can cause integer overflow in the parser, resulting in incorrect length values being used during stream processing, which can lead to a denial of service.

This vulnerability is rated as Moderate severity because a user must open or play untrusted AV1 media and exploitation results in application crash (denial of service) only, with no confidentiality or integrity impact. The AV1 LEB128 parsing code was introduced in upstream GStreamer 1.18. Red Hat Enterprise Linux 6, 7, and 8 ship gstreamer1-plugins-base and gstreamer1-plugins-bad-free versions that predate this code and are not affected. Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and RHIVOS ship affected versions below upstream fix 1.28.2. Fedora 44 and Fedora rawhide ship GStreamer 1.28.8, which includes the fix, and are not affected. Fedora 43 ships a version below 1.28.2 and is affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.