CVE-2026-12891
When processing a malformed H.266/VVC video stream with a crafted aspect ratio indicator value, the H.266 parser performs an out-of-bounds read of up to 8 bytes from adjacent memory.
Does this matter?
Lower severity and a low EPSS score (0.27%). Track it; it rarely justifies an emergency change on its own.
Description
A flaw was found in the GStreamer gst-plugins-bad package. When processing a malformed H.266/VVC video stream with a crafted aspect ratio indicator value, the H.266 parser performs an out-of-bounds read of up to 8 bytes from adjacent memory. This flaw allows an attacker to craft a malicious H.266 video file or stream that, when processed by a GStreamer-based application, could leak limited memory contents through video metadata, potentially exposing sensitive information from the application's address space.
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
- EPSS
- 0.27% probability · 20th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-125
- Affected
- gstreamer/gstreamer · redhat/enterprise linux
- Source
- secalert@redhat.com
References
- https://access.redhat.com/security/cve/CVE-2026-12891Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2491318Third Party Advisory
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5109Not Applicable
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.