CVE-2026-12892

Katalog CVE

CVSS 4.4 · Medium EPSS 0,16%

Kerentanan Out-of-bounds Read pada gstreamer, redhat enterprise linux. Skor CVSS 3.1 4.4 (Medium) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in GStreamer's gst-plugins-bad package. When processing a specially crafted H.264 video file containing malformed MVC or SVC extension slice NAL units, a 1-byte heap out-of-bounds read can occur during parsing. This happens when the parser attempts to check slice boundary information without first verifying that the NAL unit contains enough data beyond the extension header. An attacker could exploit this by tricking a user into opening a malicious H.264 video file, potentially causing the application to crash or leak a single byte of heap memory.

Rincian

Terbit di NVD

23 Juni 2026

Terakhir diubah

6 Juli 2026

Status NVD

Analyzed

CVSS 3.1

4.4 (Medium), sumber redhat.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read

EPSS (30 hari)

0,16% peluang dieksploitasi; lebih tinggi dari 4,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-12892 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2491321 advisory vendor · issue tracking
• https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5108 not applicable