{"id":"CVE-2026-12892","aliases":["DEBIAN-CVE-2026-12892","EUVD-2026-38607","GHSA-mc62-3gf7-rphg","SUSE-SU-2026:22752-1","SUSE-SU-2026:22817-1","SUSE-SU-2026:3058-1","SUSE-SU-2026:3125-1","SUSE-SU-2026:3133-1","SUSE-SU-2026:3299-1","UBUNTU-CVE-2026-12892","openSUSE-SU-2026:21370-1"],"status":"published","title":"Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad: 1-byte heap out-of-bounds read in h.264 nal extension slice parser","description":"A flaw was found in GStreamer's gst-plugins-bad package. When processing a specially crafted H.264 video file containing malformed MVC or SVC extension slice NAL units, a 1-byte heap out-of-bounds read can occur during parsing. This happens when the parser attempts to check slice boundary information without first verifying that the NAL unit contains enough data beyond the extension header. An attacker could exploit this by tricking a user into opening a malicious H.264 video file, potentially causing the application to crash or leak a single byte of heap memory.","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00157,"percentile":0.04946,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-06-23T19:53:23Z","modified":"2026-11-05T17:18:05Z","fixes":[{"ecosystem":"Debian:12","package":"gst-plugins-bad1.0","fixed_in":["1.22.0-4+deb12u8"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gst-plugins-bad1.0","fixed_in":["1.26.2-3+deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gst-plugins-bad1.0","fixed_in":["1.28.5-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-4+deb12u8"}]}],"versions":["1.22.0-4","1.22.0-4+deb12u1","1.22.0-4+deb12u2","1.22.0-4+deb12u3","1.22.0-4+deb12u4","1.22.0-4+deb12u5","1.22.0-4+deb12u6","1.22.0-4+deb12u7"]},{"source":"osv","ecosystem":"Debian:13","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-3+deb13u3"}]}],"versions":["1.26.2-3","1.26.2-3+deb13u1","1.26.2-3+deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.5-1"}]}],"versions":["1.26.10-1","1.26.10-2","1.26.2-3","1.26.3-1","1.26.4-1","1.26.5-1","1.26.5-2","1.26.6-1","1.26.6-2","1.26.6-3","1.26.6-4","1.26.6-5","1.26.7-1","1.26.7-2","1.26.8-1","1.26.9-1","1.27.1-1","1.27.2-1","1.27.50-1","1.27.90-1","1.27.90-2","1.27.90-3","1.28.0-1","1.28.1-1","1.28.1-2","1.28.1-3","1.28.2-1","1.28.2-2","1.28.3-1","1.28.4-1"]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.4.9.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.4.9.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.4.9.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.4.9.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.4.9.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.3.34.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.3.34.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.3.34.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.3.34.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.29.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.29.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.29.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.29.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-18.21.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-18.21.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.0-3ubuntu5","1.2.1-1ubuntu1","1.2.1-1ubuntu2","1.2.2-1ubuntu1","1.2.2-1ubuntu2","1.2.2-1ubuntu4","1.2.3-1ubuntu1","1.2.3-1ubuntu2","1.2.4-1~ubuntu1","1.2.4-1~ubuntu1.1","1.2.4-1~ubuntu1.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.0-1ubuntu1","1.6.1-1ubuntu1","1.6.2-1ubuntu1","1.7.1-1ubuntu1","1.7.1-1ubuntu3","1.7.1-1ubuntu4","1.7.2-1ubuntu1","1.7.90-1ubuntu2","1.7.91-1ubuntu1","1.8.0-1ubuntu1","1.8.1-1ubuntu0.1","1.8.2-1ubuntu0.1","1.8.2-1ubuntu0.2","1.8.3-1ubuntu0.2","1.8.3-1ubuntu0.2+esm1","1.8.3-1ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.12.3-1ubuntu1","1.12.3-1ubuntu2","1.12.3-2ubuntu1","1.12.4-2ubuntu1","1.12.4-2ubuntu2","1.13.1-1ubuntu1","1.13.91-1ubuntu1","1.14.0-1ubuntu1","1.14.1-1ubuntu1~ubuntu18.04.1","1.14.4-1ubuntu1~ubuntu18.04.1","1.14.5-0ubuntu1~18.04.1","1.14.5-0ubuntu1~18.04.1+esm1","1.14.5-0ubuntu1~18.04.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.1-1ubuntu1","1.16.1-1ubuntu3","1.16.1-1ubuntu4","1.16.1-1ubuntu5","1.16.1-1ubuntu6","1.16.1-1ubuntu8","1.16.2-1ubuntu1","1.16.2-1ubuntu2","1.16.2-2ubuntu1","1.16.2-2.1ubuntu1","1.16.3-0ubuntu1","1.16.3-0ubuntu1.1","1.16.3-0ubuntu1.1+esm1","1.16.3-0ubuntu1.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.5-1ubuntu1","1.18.5-1ubuntu3","1.20.0-2ubuntu2","1.20.1-1ubuntu2","1.20.3-0ubuntu1","1.20.3-0ubuntu1.1","1.20.3-0ubuntu1.1+esm2","1.20.3-0ubuntu1.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.4-1ubuntu1","1.22.4-1ubuntu2","1.22.4-1ubuntu4","1.22.9-2ubuntu1","1.24.0-1ubuntu3","1.24.0-1ubuntu4","1.24.2-1ubuntu4","1.24.2-1ubuntu4+esm1","1.24.2-1ubuntu4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.0-1ubuntu2","1.26.2-1ubuntu1","1.26.3-1ubuntu1","1.26.4-1ubuntu1","1.26.5-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.28.2-1ubuntu1","1.28.2-1ubuntu2","1.28.4-1ubuntu1","1.28.4-1ubuntu2","1.28.6-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.5-1ubuntu2","1.27.2-1ubuntu1","1.27.90-1ubuntu2","1.28.0-1ubuntu2","1.28.1-2ubuntu2","1.28.1-2ubuntu3","1.28.2-1ubuntu1","1.28.2-1ubuntu1.1","1.28.2-1ubuntu1.2"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.3.1"}]}],"bundled":9}],"products":[{"vendor":"gstreamer","product":"gstreamer"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-12892","tags":["vdb-entry","x_refsource_REDHAT","Vendor Advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491321","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Vendor Advisory","report"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5108","tags":["Not Applicable","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12892"},{"url":"https://github.com/advisories/GHSA-mc62-3gf7-rphg"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-12892","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622752-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268168","tags":["report"]},{"url":"https://bugzilla.suse.com/1268172","tags":["report"]},{"url":"https://bugzilla.suse.com/1268406","tags":["report"]},{"url":"https://bugzilla.suse.com/1268408","tags":["report"]},{"url":"https://bugzilla.suse.com/1268410","tags":["report"]},{"url":"https://bugzilla.suse.com/1268872","tags":["report"]},{"url":"https://bugzilla.suse.com/1268971","tags":["report"]},{"url":"https://bugzilla.suse.com/1271051","tags":["report"]},{"url":"https://bugzilla.suse.com/1271168","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59692","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622817-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263058-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263125-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263133-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263299-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-12892","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12892","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-12892","title":"Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad: 1-byte heap out-of-bounds read in h.264 nal extension slice parser","description":"A flaw was found in GStreamer's gst-plugins-bad package. When processing a specially crafted H.264 video file containing malformed MVC or SVC extension slice NAL units, a 1-byte heap out-of-bounds read can occur during parsing. This happens when the parser attempts to check slice boundary information without first verifying that the NAL unit contains enough data beyond the extension header. An attacker could exploit this by tricking a user into opening a malicious H.264 video file, potentially causing the application to crash or leak a single byte of heap memory.","status":"published","published":"2026-06-23T19:53:23.402Z","modified":"2026-11-05T17:03:25.303Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-05T18:54:21.089916Z"}],"euvd":[{"id":"EUVD-2026-38607","description":"A flaw was found in GStreamer's gst-plugins-bad package. When processing a specially crafted H.264 video file containing malformed MVC or SVC extension slice NAL units, a 1-byte heap out-of-bounds read can occur during parsing. This happens when the parser attempts to check slice boundary information without first verifying that the NAL unit contains enough data beyond the extension header. An attacker could exploit this by tricking a user into opening a malicious H.264 video file, potentially causing the application to crash or leak a single byte of heap memory.","status":"published","published":"2026-06-23T19:53:23Z","modified":"2026-11-05T17:03:25Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-05T18:00:57.218327Z"}],"ghsa":[{"id":"GHSA-mc62-3gf7-rphg","title":"A flaw was found in GStreamer's gst-plugins-bad package. When processing a specially crafted H...","description":"A flaw was found in GStreamer's gst-plugins-bad package. When processing a specially crafted H.264 video file containing malformed MVC or SVC extension slice NAL units, a 1-byte heap out-of-bounds read can occur during parsing. This happens when the parser attempts to check slice boundary information without first verifying that the NAL unit contains enough data beyond the extension header. An attacker could exploit this by tricking a user into opening a malicious H.264 video file, potentially causing the application to crash or leak a single byte of heap memory.","status":"published","published":"2026-06-23T21:30:32Z","modified":"2026-06-23T21:30:39Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:08:57.478089Z"}],"nvd":[{"id":"CVE-2026-12892","description":"A flaw was found in GStreamer's gst-plugins-bad package. When processing a specially crafted H.264 video file containing malformed MVC or SVC extension slice NAL units, a 1-byte heap out-of-bounds read can occur during parsing. This happens when the parser attempts to check slice boundary information without first verifying that the NAL unit contains enough data beyond the extension header. An attacker could exploit this by tricking a user into opening a malicious H.264 video file, potentially causing the application to crash or leak a single byte of heap memory.","status":"published","published":"2026-06-23T21:16:55.07Z","modified":"2026-11-05T17:18:05.04Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-05T19:55:55.702046Z"}],"osv":[{"id":"DEBIAN-CVE-2026-12892","description":"A flaw was found in GStreamer's gst-plugins-bad package. When processing a specially crafted H.264 video file containing malformed MVC or SVC extension slice NAL units, a 1-byte heap out-of-bounds read can occur during parsing. This happens when the parser attempts to check slice boundary information without first verifying that the NAL unit contains enough data beyond the extension header. An attacker could exploit this by tricking a user into opening a malicious H.264 video file, potentially causing the application to crash or leak a single byte of heap memory.","status":"published","published":"2026-06-23T21:16:55.07Z","modified":"2026-10-16T11:00:06.076577412Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:51.374409Z"},{"id":"UBUNTU-CVE-2026-12892","description":"A flaw was found in GStreamer's gst-plugins-bad package. When processing a specially crafted H.264 video file containing malformed MVC or SVC extension slice NAL units, a 1-byte heap out-of-bounds read can occur during parsing. This happens when the parser attempts to check slice boundary information without first verifying that the NAL unit contains enough data beyond the extension header. An attacker could exploit this by tricking a user into opening a malicious H.264 video file, potentially causing the application to crash or leak a single byte of heap memory.","status":"published","published":"2026-06-23T21:16:00Z","modified":"2026-10-17T12:59:52.718824982Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:56:00.592716Z"},{"id":"openSUSE-SU-2026:21370-1","title":"Security update for gstreamer-plugins-bad","description":"This update for gstreamer-plugins-bad fixes the following issues\n\n- CVE-2026-12891: unchecked aspect_ratio_idc value used as an array index in the H.266 parser could cause a global out-\n  of-bounds read (bsc#1268872).\n- CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser (bsc#1268971).\n- CVE-2026-14935: webrtcbin accepts remote SDP without a=fingerprint due to inverted presence check (bsc#1271051).\n- CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write\n  (bsc#1268406).\n- CVE-2026-52721: crafted PCAP records during IPv4 or TCP header parsing could cause an out-of-bounds read\n  (bsc#1268408).\n- CVE-2026-52722: crafted VMnc stream with large cursor dimensions can overflow signed integer (bsc#1268410).\n- CVE-2026-53701: multi-slice-in-tile partitions without slice index bounds checks could trigger an out-of-bounds write\n  (bsc#1268172).\n- CVE-2026-53702: incorrect loop bound during H.265 SEI message parsing could result in a stack buffer overflow\n  (bsc#1268168).\n- CVE-2026-59692: unvalidated peer certificate Subject DN printed during a DTLS handshake could cause a stack buffer\n  overflow (bsc#1271168).\n","status":"published","published":"2026-07-18T06:18:17Z","modified":"2026-07-22T18:25:10.908937951Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22752-1","title":"Security update for gstreamer-plugins-bad","description":"This update for gstreamer-plugins-bad fixes the following issues\n\n- CVE-2026-12891: unchecked aspect_ratio_idc value used as an array index in the H.266 parser could cause a global out-\n  of-bounds read (bsc#1268872).\n- CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser (bsc#1268971).\n- CVE-2026-14935: webrtcbin accepts remote SDP without a=fingerprint due to inverted presence check (bsc#1271051).\n- CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write\n  (bsc#1268406).\n- CVE-2026-52721: crafted PCAP records during IPv4 or TCP header parsing could cause an out-of-bounds read\n  (bsc#1268408).\n- CVE-2026-52722: crafted VMnc stream with large cursor dimensions can overflow signed integer (bsc#1268410).\n- CVE-2026-53701: multi-slice-in-tile partitions without slice index bounds checks could trigger an out-of-bounds write\n  (bsc#1268172).\n- CVE-2026-53702: incorrect loop bound during H.265 SEI message parsing could result in a stack buffer overflow\n  (bsc#1268168).\n- CVE-2026-59692: unvalidated peer certificate Subject DN printed during a DTLS handshake could cause a stack buffer\n  overflow (bsc#1271168).\n","status":"published","published":"2026-07-18T06:19:25Z","modified":"2026-07-23T18:24:19.307658597Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22817-1","title":"Security update for gstreamer-plugins-bad","description":"This update for gstreamer-plugins-bad fixes the following issues\n\n- CVE-2026-12891: unchecked aspect_ratio_idc value used as an array index in the H.266 parser could cause a global out-\n  of-bounds read (bsc#1268872).\n- CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser (bsc#1268971).\n- CVE-2026-14935: webrtcbin accepts remote SDP without a=fingerprint due to inverted presence check (bsc#1271051).\n- CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write\n  (bsc#1268406).\n- CVE-2026-52721: crafted PCAP records during IPv4 or TCP header parsing could cause an out-of-bounds read\n  (bsc#1268408).\n- CVE-2026-52722: crafted VMnc stream with large cursor dimensions can overflow signed integer (bsc#1268410).\n- CVE-2026-53701: multi-slice-in-tile partitions without slice index bounds checks could trigger an out-of-bounds write\n  (bsc#1268172).\n- CVE-2026-53702: incorrect loop bound during H.265 SEI message parsing could result in a stack buffer overflow\n  (bsc#1268168).\n- CVE-2026-59692: unvalidated peer certificate Subject DN printed during a DTLS handshake could cause a stack buffer\n  overflow (bsc#1271168).\n","status":"published","published":"2026-07-18T06:19:25Z","modified":"2026-07-28T18:24:07.725510396Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:3058-1","title":"Security update for gstreamer-plugins-bad","description":"This update for gstreamer-plugins-bad fixes the following issues\n\n- CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser (bsc#1268971).\n- CVE-2026-14935: webrtcbin accepts remote SDP without a=fingerprint due to inverted presence check (bsc#1271051).\n- CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write\n  (bsc#1268406).\n- CVE-2026-52721: crafted PCAP records during IPv4 or TCP header parsing could cause an out-of-bounds read\n  (bsc#1268408).\n- CVE-2026-52722: crafted VMnc stream with large cursor dimensions can overflow signed integer (bsc#1268410).\n- CVE-2026-53702: incorrect loop bound during H.265 SEI message parsing could result in a stack buffer overflow\n  (bsc#1268168).\n- CVE-2026-59692: unvalidated peer certificate Subject DN printed during a DTLS handshake could cause a stack buffer\n  overflow (bsc#1271168).\n","status":"published","published":"2026-07-15T13:32:27Z","modified":"2026-07-16T10:00:14.970960709Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3125-1","title":"Security update for gstreamer-plugins-bad","description":"This update for gstreamer-plugins-bad fixes the following issues:\n\n- CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser (bsc#1268971).\n- CVE-2026-14935: webrtcbin accepts remote SDP without a=fingerprint due to inverted presence check (bsc#1271051).\n- CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write\n  (bsc#1268406).\n- CVE-2026-52721: crafted PCAP records during IPv4 or TCP header parsing could cause an out-of-bounds read\n  (bsc#1268408).\n- CVE-2026-52722: crafted VMnc stream with large cursor dimensions can overflow signed integer (bsc#1268410).\n- CVE-2026-53702: incorrect loop bound during H.265 SEI message parsing could result in a stack buffer overflow\n  (bsc#1268168).\n- CVE-2026-59692: unvalidated peer certificate Subject DN printed during a DTLS handshake could cause a stack buffer\n  overflow (bsc#1271168).\n","status":"published","published":"2026-07-20T07:01:46Z","modified":"2026-07-21T09:45:05.328112639Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3133-1","title":"Security update for gstreamer-plugins-bad","description":"This update for gstreamer-plugins-bad fixes the following issues\n\n- CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser (bsc#1268971).\n- CVE-2026-14935: webrtcbin accepts remote SDP without a=fingerprint due to inverted presence check (bsc#1271051).\n- CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write (bsc#1268406).\n- CVE-2026-52721: crafted PCAP records during IPv4 or TCP header parsing could cause an out-of-bounds read (bsc#1268408).\n- CVE-2026-52722: crafted VMnc stream with large cursor dimensions can overflow signed integer (bsc#1268410).\n- CVE-2026-53702: incorrect loop bound during H.265 SEI message parsing could result in a stack buffer overflow (bsc#1268168).\n- CVE-2026-59692: unvalidated peer certificate Subject DN printed during a DTLS handshake could cause a stack buffer overflow (bsc#1271168).\n","status":"published","published":"2026-07-20T13:58:50Z","modified":"2026-07-21T09:45:05.363420605Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3299-1","title":"Security update for gstreamer-plugins-bad","description":"This update for gstreamer-plugins-bad fixes the following issues:\n\n- CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser (bsc#1268971).\n- CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write\n  (bsc#1268406).\n- CVE-2026-52721: crafted PCAP records during IPv4 or TCP header parsing could cause an out-of-bounds read\n  (bsc#1268408).\n- CVE-2026-52722: crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic\n  (bsc#1268410).\n- CVE-2026-53702: incorrect loop bound during H.265 SEI message parsing could result in a stack buffer overflow\n  (bsc#1268168).\n- CVE-2026-59692: unvalidated peer certificate Subject DN printed during a DTLS handshake could cause a stack buffer\n  overflow (bsc#1271168).\n","status":"published","published":"2026-07-27T16:58:29Z","modified":"2026-07-28T10:00:10.490626679Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}