CVE-2026-12891

A flaw was found in the GStreamer gst-plugins-bad package. When processing a malformed H.266/VVC video stream with a crafted aspect ratio indicator value, the H.266 parser performs an out-of-bounds read of up to 8 bytes from adjacent memory. This flaw allows an attacker to craft a malicious H.266 video file or stream that, when processed by a GStreamer-based application, could leak limited memory contents through video metadata, potentially exposing sensitive information from the application's address space.

Red Hat Enterprise Linux versions that ship gstreamer1-plugins-bad with H.266/VVC parser support are affected by this vulnerability. The impact is rated Moderate because exploitation requires user interaction (opening or streaming a malicious H.266 media file) and the information disclosure is limited to 8 bytes from the read-only .data section per malformed frame, making it difficult to extract meaningful sensitive data in practice. The vulnerability does not lead to code execution or denial of service under normal circumstances. Versions of gstreamer1-plugins-bad that do not include H.266/VVC parser support (typically older releases before the H.266 codec was added) are not affected by this specific vulnerability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.