Cpe:2.3:a:gstreamer:gst-Plugins-Bad:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3agstreamergst-plugins-bad/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 19:36:47 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgGStreamer gst-plugins-bad: Integer overflow in H.266/VVC parser (CVE-2026-119777)https://feed.craftedsignal.io/briefs/2026-10-gstreamer-buffer-overflow/Fri, 30 Oct 2026 19:36:47 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-gstreamer-buffer-overflow/An integer overflow vulnerability in GStreamer's gst-plugins-bad H.266/VVC parser can lead to stack-based buffer overflows and potential arbitrary code execution when processing malformed media.A vulnerability exists in the GStreamer gst-plugins-bad component within the H.266/VVC parser (CVE-2026-119777). An integer overflow occurs when the parser processes the profile, tier, and level fields of a malformed H.266 media file or stream. This overflow results in a stack-based buffer overflow, which can lead to application crashes or arbitrary code execution in the context of the process handling the media.

Impact

Successful exploitation allows for an application crash (Denial of Service) or potential arbitrary code execution within the security context of the affected application process.

Recommendation

Inventory all applications utilizing the GStreamer framework and specifically the gst-plugins-bad component. Monitor official GStreamer project security advisories for patch availability and upgrade immediately upon release.

]]>highadvisory