{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3agstreamergst-plugins-bad/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:gstreamer:gst-plugins-bad:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-119777"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["gst-plugins-bad"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["GStreamer"],"content_html":"\u003cp\u003eA vulnerability exists in the GStreamer gst-plugins-bad component within the H.266/VVC parser (CVE-2026-119777). An integer overflow occurs when the parser processes the profile, tier, and level fields of a malformed H.266 media file or stream. This overflow results in a stack-based buffer overflow, which can lead to application crashes or arbitrary code execution in the context of the process handling the media.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for an application crash (Denial of Service) or potential arbitrary code execution within the security context of the affected application process.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eInventory all applications utilizing the GStreamer framework and specifically the gst-plugins-bad component. Monitor official GStreamer project security advisories for patch availability and upgrade immediately upon release.\u003c/p\u003e\n","date_modified":"2026-10-30T19:36:47Z","date_published":"2026-10-30T19:36:47Z","id":"https://feed.craftedsignal.io/briefs/2026-10-gstreamer-buffer-overflow/","summary":"An integer overflow vulnerability in GStreamer's gst-plugins-bad H.266/VVC parser can lead to stack-based buffer overflows and potential arbitrary code execution when processing malformed media.","title":"GStreamer gst-plugins-bad: Integer overflow in H.266/VVC parser (CVE-2026-119777)","url":"https://feed.craftedsignal.io/briefs/2026-10-gstreamer-buffer-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:gstreamer:gst-Plugins-Bad:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}