The vulnerability CVE-2026-12891 affects the GStreamer gst-plugins-bad package in Red Hat Enterprise Linux 10. When processing a maliciously crafted H.266/VVC video stream containing a malformed aspect ratio indicator, the H.266 parser performs an out-of-bounds read of up to 8 bytes from adjacent memory. This can cause limited leakage of memory contents via video metadata, potentially exposing sensitive data from the application's address space. The CVSS v3.1 base score is 4.3 (medium severity), reflecting a network attack vector with low complexity, no privileges required, and user interaction needed. Red Hat has published an advisory but has not explicitly stated a remediation or patch status.

An attacker can craft a malicious H.266 video file or stream that triggers an out-of-bounds read in the GStreamer H.266 parser, leading to limited disclosure of memory contents. This could expose sensitive information from the application's memory space. There is no indication of integrity or availability impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-12891 for current remediation guidance. Until a patch is available, avoid processing untrusted H.266/VVC video streams with vulnerable versions of GStreamer gst-plugins-bad to mitigate potential information leakage.