The vulnerability CVE-2026-12891 affects the GStreamer gst-plugins-bad package in Red Hat Enterprise Linux 10. When the H.266 parser processes a malformed H.266/VVC video stream containing a crafted aspect ratio indicator value, it performs an out-of-bounds read of up to 8 bytes from adjacent memory. This can lead to leakage of limited memory contents via video metadata, potentially exposing sensitive information from the application's address space. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity) with network attack vector, low attack complexity, no privileges required, and requires user interaction. No known exploits are reported in the wild. The vendor advisory does not currently specify a patch or remediation status.

An attacker can craft a malicious H.266 video file or stream that triggers an out-of-bounds read in the vulnerable parser, causing limited memory contents to be leaked through video metadata. This may expose sensitive information from the application's address space. The impact is confidentiality loss only, with no integrity or availability impact reported. The vulnerability requires user interaction and network access to exploit.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-12891 for current remediation guidance. Until a patch is available, avoid processing untrusted or malformed H.266/VVC video streams with GStreamer-based applications to reduce exposure.