Security Advisory 2026-0096 (CVE-2026-116611)
| Summary | Multiple out-of-bounds reads, null pointer write and denial of service in the VMnc video decoder |
| Date | 2026-11-06 |
| Affected Versions | GStreamer gst-plugins-bad < 1.28.9 |
| IDs | GStreamer-SA-2026-0096 CVE-2026-116611 |
Details
Multiple vulnerabilities in the VMnc video decoder (vmncdec) in gst-plugins-bad when decoding crafted streams, which are commonly found in AVI files.
Cursor image buffers are sized according to the pixel format in effect when the cursor is defined. A pixel format change later in the stream made the decoder render the cursor with the new, larger pixel size and read up to four times the allocation, mixing out-of-bounds heap content into the decoded video frames. Related out-of-bounds reads occur when the internal image buffer is smaller than the padded output frame it is copied to, and a null-pointer write of image data occurs when the decoder parses the stream without a demuxer and never allocates that buffer.
In addition, frame dimensions from the stream were not validated, allowing a small header to request allocations of multiple gigabytes, and pixel data was read through unaligned memory accesses that can crash the process on architectures which enforce alignment.
Impact
A malicious third party could crash the application or leak adjacent heap memory into decoded video frames by supplying a crafted media file or stream containing a malicious VMnc video stream. The decoder is automatically selected for media files using this codec, so no user interaction beyond opening, playing or thumbnailing a crafted file is required.
Solution
The gst-plugins-bad 1.28.9 release addresses the issues. People using older versions of GStreamer should apply the patch and recompile.