Security Advisory 2026-0094 (CVE-2026-121611)
| Summary | Use of uninitialized memory in H.265 bitstream parser |
| Date | 2026-11-06 |
| Affected Versions | GStreamer gst-plugins-bad < 1.28.9 |
| IDs | GStreamer-SA-2026-0094 CVE-2026-121611 |
Details
A use of uninitialized memory vulnerability in the H.265 bitstream parser in gst-plugins-bad. When parsing the timing and buffering information of a video parameter set, many fields are only coded in the bitstream if flags in the same structure say so, and the parser did not initialize the fields that are absent from the bitstream before using them. This occurs when a stream declares more than one set of these buffering parameters, as the additional sets are parsed into memory that was never initialized. The uninitialized values influence decisions made while parsing, so a crafted stream can make the parser behave unpredictably, and the uninitialized values can also be handed to components that use the parsed parameters to configure H.265 decoders.
This affects all versions of gst-plugins-bad before 1.28.9.
Impact
A malicious third party could trigger the use of uninitialized memory by providing a crafted H.265 bitstream, either in a file or as part of a stream. This can result in unpredictable parser behavior, incorrect decoder configuration, and an application crash or denial of service.
Solution
The gst-plugins-bad 1.28.9 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.