CVE-2026-119777

A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow. An attacker could cause an application to crash and may be able to execute code in the context of the affected application.

This vulnerability is rated as Important because a crafted H.266/VVC bitstream can cause a stack out-of-bounds write in GStreamer, potentially crashing the application or allowing code execution with the application's privileges. Exploitation requires a GStreamer-based application to process attacker-controlled H.266/VVC media; a user or service must open or ingest the file or stream. Based on the currently recorded package versions, gstreamer1-plugins-bad-free in RHEL 10.2.z, 10.3.z, and 10.4 and RHIVOS 2.1 and 2.1-core is affected. Fedora 43, including its MinGW package, is also affected. RHEL 7 through 9 and RHEL 10.0 ship versions that predate the vulnerable code. Fedora 44 and Rawhide ship versions in which the vulnerable code is no longer present.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

There is no complete mitigation for this vulnerability. As a risk-reduction measure, disable H.266/VVC media ingestion in GStreamer-based applications and media pipelines where that feature is not required. Until a fixed package is available, do not open or transcode H.266/VVC files or streams from untrusted sources.