Threats Tagged 'cve-2026-12891'

Multiple security vulnerabilities have been identified and fixed in the gstreamer-plugins-bad component. These include out-of-bounds reads and writes, heap and stack buffer overflows, and improper validation issues affecting various parsers such as H.264, H.265, H.266, WebRTC, IPv4/TCP headers, and DTLS handshake processing. The issues could lead to memory corruption or crashes. No CVSS score is provided, but the severity is assessed as high due to the nature of the vulnerabilities.

A flaw was found in the GStreamer gst-plugins-bad package. When processing a malformed H.266/VVC video stream with a crafted aspect ratio indicator value, the H.266 parser performs an out-of-bounds read of up to 8 bytes from adjacent memory. This flaw allows an attacker to craft a malicious H.266 video file or stream that, when processed by a GStreamer-based application, could leak limited memory contents through video metadata, potentially exposing sensitive information from the application's address space.