Use of Uninitialized Memory Vulnerability in GStreamer's H.265 Parser

CVE-2026-121611

What is CVE-2026-121611?

A vulnerability exists in GStreamer's gst-plugins-bad package related to the H.265 bitstream parser. Specifically, the flaw occurs when handling Video Parameter Sets that mistakenly declare more than one Hypothetical Reference Decoder (HRD) parameter set. A malicious actor could exploit this vulnerability by supplying a specifically crafted H.265 media file or stream. The exploitation may result in unpredictable behavior in the parser and could potentially crash any application relying on GStreamer to play back H.265 content, leading to a denial of service scenario.

References