CVE-2026-121611
Gstreamer1-plugins-bad-free: gst-plugins-bad: use of uninitialized gsth265hrdparams in gst_h265_parse_vps() multi-hrd workaround loop
A flaw was found in GStreamer's gst-plugins-bad package. A use of uninitialized memory vulnerability exists in the H.265 (HEVC) bitstream parser when processing Video Parameter Sets that declare more than one HRD (Hypothetical Reference Decoder) parameter set. A remote attacker could exploit this by providing a crafted H.265 media file or stream that, when processed by an application using GStreamer, causes unpredictable parser behavior and may crash the application. This can lead to a denial of service for any application using GStreamer to play back H.265 content.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
What each source reports
CVE List Score used
Gstreamer1-plugins-bad-free: gst-plugins-bad: use of uninitialized gsth265hrdparams in gst_h265_parse_vps() multi-hrd workaround loop
A flaw was found in GStreamer's gst-plugins-bad package. A use of uninitialized memory vulnerability exists in the H.265 (HEVC) bitstream parser when processing Video Parameter Sets that declare more than one HRD (Hypothetical Reference Decoder) parameter set. A remote attacker could exploit this by providing a crafted H.265 media file or stream that, when processed by an application using GStreamer, causes unpredictable parser behavior and may crash the application. This can lead to a denial of service for any application using GStreamer to play back H.265 content.
- Record
CVE-2026-121611- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-457
- Updated
- 2026-11-09
EUVDEUVD-2026-120052
A flaw was found in GStreamer's gst-plugins-bad package. A use of uninitialized memory vulnerability exists in the H.265 (HEVC) bitstream parser when processing Video Parameter Sets that declare more than one HRD (Hypothetical Reference Decoder) parameter set. A remote attacker could exploit this by providing a crafted H.265 media file or stream that, when processed by an application using GStreamer, causes unpredictable parser behavior and may crash the application. This can lead to a denial of service for any application using GStreamer to play back H.265 content.
- Record
EUVD-2026-120052- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-09
GitHub AdvisoriesGHSA-m394-f7p9-g5gg
A flaw was found in GStreamer's gst-plugins-bad package. A use of uninitialized memory...
A flaw was found in GStreamer's gst-plugins-bad package. A use of uninitialized memory vulnerability exists in the H.265 (HEVC) bitstream parser when processing Video Parameter Sets that declare more than one HRD (Hypothetical Reference Decoder) parameter set. A remote attacker could exploit this by providing a crafted H.265 media file or stream that, when processed by an application using GStreamer, causes unpredictable parser behavior and may crash the application. This can lead to a denial of service for any application using GStreamer to play back H.265 content.
- Record
GHSA-m394-f7p9-g5gg- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-457
- Updated
- 2026-11-09
NVD
A flaw was found in GStreamer's gst-plugins-bad package. A use of uninitialized memory vulnerability exists in the H.265 (HEVC) bitstream parser when processing Video Parameter Sets that declare more than one HRD (Hypothetical Reference Decoder) parameter set. A remote attacker could exploit this by providing a crafted H.265 media file or stream that, when processed by an application using GStreamer, causes unpredictable parser behavior and may crash the application. This can lead to a denial of service for any application using GStreamer to play back H.265 content.
- Record
CVE-2026-121611- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-457
- Updated
- 2026-11-09
OSVDEBIAN-CVE-2026-121611
- Record
DEBIAN-CVE-2026-121611- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-10
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gst-plugins-bad1.0Debian:12 |
All versions, plus listed versions 1.22.0-41.22.0-4+deb12u11.22.0-4+deb12u21.22.0-4+deb12u31.22.0-4+deb12u4 Show 45 moreShow less1.22.0-4+deb12u51.22.0-4+deb12u61.22.0-4+deb12u71.22.0-4+deb12u81.22.1-11.22.10-11.22.3-11.22.3-21.22.4-11.22.7-11.22.8-11.22.9-11.22.9-21.23.1-11.23.2-11.23.90-11.24.0-11.24.1-11.24.1-21.24.1-31.24.1-41.24.10-11.24.10-21.24.10-2+hurd.11.24.10-31.24.11-11.24.11-21.24.11-31.24.12-11.24.12-21.24.12-31.24.2-11.24.2-21.24.2-31.24.2-41.24.3-11.24.4-11.24.4-21.24.5-11.24.6-11.24.7-11.24.8-11.24.8-21.24.9-11.25.1-1 |
None known |
gst-plugins-bad1.0Debian:13 |
All versions, plus listed versions 1.26.10-11.26.10-21.26.2-31.26.2-3+deb13u11.26.2-3+deb13u2 Show 38 moreShow less1.26.2-3+deb13u31.26.3-11.26.4-11.26.5-11.26.5-21.26.6-11.26.6-21.26.6-31.26.6-41.26.6-51.26.7-11.26.7-21.26.8-11.26.9-11.27.1-11.27.2-11.27.50-11.27.90-11.27.90-21.27.90-31.28.0-11.28.1-11.28.1-21.28.1-31.28.2-11.28.2-21.28.3-11.28.4-11.28.5-11.28.5-21.28.6-11.28.7-11.28.7-21.28.8-11.28.9-11.29.1-11.29.2-11.29.2-2 |
None known |
gst-plugins-bad1.0Debian:14 |
All versions, plus listed versions 1.26.10-11.26.10-21.26.2-31.26.3-11.26.4-1 Show 35 moreShow less1.26.5-11.26.5-21.26.6-11.26.6-21.26.6-31.26.6-41.26.6-51.26.7-11.26.7-21.26.8-11.26.9-11.27.1-11.27.2-11.27.50-11.27.90-11.27.90-21.27.90-31.28.0-11.28.1-11.28.1-21.28.1-31.28.2-11.28.2-21.28.3-11.28.4-11.28.5-11.28.5-21.28.6-11.28.7-11.28.7-21.28.8-11.28.9-11.29.1-11.29.2-11.29.2-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| published | EUVD | |
| published | EUVD, NVD | |
| aliases, references | GitHub Advisories | |
| aliases, published | EUVD | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-121611 is a medium vulnerability (CVSS 6.5) in Red Hat Enterprise Linux 10, published November 9, 2026. No source lists public exploit code. No source names a fixed version.
References
access.redhat.com/security/cve/CVE-2026-121611
bugzilla.redhat.com/show_bug.cgi?id=2565937
gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5332
gstreamer.freedesktop.org/security/sa-2026-0094.html
nvd.nist.gov/vuln/detail/CVE-2026-121611
github.com/advisories/GHSA-m394-f7p9-g5gg
security-tracker.debian.org/tracker/CVE-2026-121611
Left out here: 50 versions. The JSON record has them.