6.5

CVE-2026-119727: Gst-plugins-bad: gst-plugins-bad: h.265 sps scc palette predictor array overflow via integer underflow in bounds computation

Awaiting analysis
AliasesDEBIAN-CVE-2026-119727UBUNTU-CVE-2026-119727
Published 30-10-2026Last modified 03-11-2026

Vulnerability summary

CVE-2026-119727 is a medium (CVSS 6.5) Heap-based Buffer Overflow vulnerability in gstreamer project gst-plugins-bad. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 16.7% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.25%
0%100%
Low · Change unavailable
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Timeline

  1. 30-10-2026
    PublishedVulnerability first disclosed.
  2. 03-11-2026
    Last modifiedVulnerability information updated.

Description

A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the parser to accept an out-of-range value for the number of palette predictor entries. This causes the parser to write beyond the end of a fixed-size array, resulting in memory corruption and an application crash. Successful exploitation requires an attacker to provide a malformed H.265 media file to a vulnerable application, and is limited to a denial-of-service impact.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.25%

Chance of exploitation in the next 30 days

Percentile

17%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

31-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Debian1 product
  • gst-plugins-bad1.0All versions (No fix recorded) | < 1.28.1-1
Gstreamer project1 product
Ubuntu1 product
  • gst-plugins-bad1.0All versions (No fix recorded)

3 vendors · 3 products

References

8 links