CVE-2026-12891: Gstreamer1-plugins-bad: gstreamer1-plugins-bad: global buffer overflow (oob read) in h.266/vvc vui parameter parser
A flaw was found in the GStreamer gst-plugins-bad package. When processing a malformed H.266/VVC video stream with a crafted aspect ratio indicator value, the H.266 parser performs an out-of-bounds read of up to 8 bytes from adjacent memory. This flaw allows an attacker to craft a malicious H.266 video file or stream that, when processed by a GStreamer-based application, could leak limited memory contents through video metadata, potentially exposing sensitive information from the application's address space.
Other sources
A global buffer overflow (out-of-bounds read) was found in GStreamer's gst-plugins-bad H.266/VVC parser in the gsth266parsevuiparameters() function at subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gsth266parser.c:561. The aspectratioidc field is read as an 8-bit value (0-255) from the H.266 bitstream and used directly as an array index into the aspectratios[] array, which contains only 17 entries (indices 0-16). When aspectratioidc is 17-254, the code performs an 8-byte out-of-bounds read from the .data section (reading two guint fields: parn and pard). The H.265 parser (gsth265parser.c) contains the correct bounds check (else if (vui->aspectratioidc <= 16)) which is missing in the H.266 implementation, indicating this was an oversight during porting. The leaked values are stored in GstH266VUIParams and propagated to GStreamer caps as pixel-aspect-ratio metadata, affecting video scaling in downstream components. Upstream maintainer Sebastian Dröge confirmed the vulnerability is valid and that the proposed patch is correct. The bug affects all versions containing the H.266 parser. Reported by Dr. Faruk Kazi and Ramesh Adhikari from CoE-CNDS Lab, VJTI, Mumbai, India. Upstream tracking: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/workitems/5109
PSIRT Ticket: PSIRTSUPT-17586
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12891?
CVE-2026-12891 has a medium severity rating of 4.3.
What is the nature of the vulnerability in CVE-2026-12891?
CVE-2026-12891 involves a global buffer overflow due to an out-of-bounds read in the H.266/VVC parameter parser.
How does CVE-2026-12891 affect GStreamer?
CVE-2026-12891 affects the GStreamer gst-plugins-bad package when processing malformed H.266/VVC video streams.
How do I fix CVE-2026-12891?
To fix CVE-2026-12891, update to the latest version of the GStreamer gst-plugins-bad package that addresses the vulnerability.
Can CVE-2026-12891 be exploited remotely?
Yes, CVE-2026-12891 can potentially be exploited remotely through a crafted H.266 video stream.