Read the docs
TI-2026-83266 Aliases CVE-2026-119777GHSA-hcw3-4f5p-2hh5

Stack buffer overflow in GStreamer H.266/VVC parser

Priority MEDIUM 41CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-787 and the CVSS impact.

Summary

Red Hat Enterprise Linux 10 ships the gstreamer1-plugins-bad-free package, which contains the GStreamer H.266/VVC parser affected by this flaw. An integer overflow while parsing profile, tier, and level fields in a malformed H.266 file or stream leads to a stack-based buffer overflow (CWE-787). An attacker who supplies such a file or stream can crash the application and may be able to execute code in its context, and user interaction is required.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow. An attacker could cause an application to crash and may be able to execute code in the context of the affected application.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00543 45th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat Enterprise Linux 10——No fix listedCNA
Red HatRed Hat Enterprise Linux 7——Not affectedCNA
Red HatRed Hat Enterprise Linux 8——Not affectedCNA
Red HatRed Hat Enterprise Linux 9——Not affectedCNA
  • Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — Not affected CNA

CPE names CNA · 4

CPEVersionsRoleVendor
cpe:/a:redhat:enterprise_linux:1010—Red Hat
cpe:/o:redhat:rhel_els:77—Red Hat
cpe:/a:redhat:enterprise_linux:88—Red Hat
cpe:/a:redhat:enterprise_linux:99—Red Hat
  • cpe:/a:redhat:enterprise_linux:10 Versions 10 — ·Red Hat
  • cpe:/o:redhat:rhel_els:7 Versions 7 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:8 Versions 8 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:9 Versions 9 — ·Red Hat

Remediation

Red Hat reports no available plan for Red Hat Enterprise Linux 10. The sources list no fixed version for Red Hat Enterprise Linux 10. Red Hat Enterprise Linux 7, 8 and 9 are not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet
Not affected: 3 products
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-119777
  2. 2026-10-30 Affected versions changed · Red Hat
  3. 2026-10-30 CVSS score added · Red Hat
  4. 2026-10-30 Alias added: GHSA-hcw3-4f5p-2hh5
  5. 2026-10-30 CISA SSVC decision points changed
  6. 2026-10-30 Priority changed: MEDIUM → LOW
  7. 2026-11-03 Fix available: GStreamer project/[email protected] · CNA
  8. 2026-11-03 CVSS score changed · CNA
  9. 2026-11-03 Affected versions changed · CNA
  10. 2026-11-04 CVSS score changed · Red Hat
  11. 2026-11-05 Priority changed: LOW → MEDIUM

References

Other 3

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences