PT-2026-51590 · Gstreamer · Gst-Plugins-Bad

Ariba Afroz + 2 · Published 2026-06-23 · Updated 2026-06-23 · CVE-2026-12892

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions GStreamer gst-plugins-bad (affected versions not specified)

Description A flaw in the gst-plugins-bad package occurs when processing a specially crafted H.264 video file containing malformed Multiview Video Coding (MVC) or Scalable Video Coding (SVC) extension slice Network Abstraction Layer (NAL) units. A 1-byte heap out-of-bounds read can happen during parsing because the parser checks slice boundary information without verifying if the NAL unit contains sufficient data beyond the extension header. This could lead to an application crash or the leakage of a single byte of heap memory if a user opens a malicious file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-12892

Affected Products

Gst-Plugins-Bad

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-12892 · Security Note
• https://twitter.com/CVEnew/status/2069566784219308336 · Twitter Post
• https://twitter.com/infoflowcloud/status/2069567818400502198 · Twitter Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2491321 · Note
• https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5108 · Note
• https://access.redhat.com/security/cve/CVE-2026-12892 · Note