{"id":"CVE-2026-119777","aliases":[],"cve":{"records":[{"id":"CVE-2026-119777","source":"redhat","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-30T16:19:44.205Z","published":"2026-10-30T17:59:41.041Z","modified":"2026-10-30T19:20:39.082Z"}],"publishers":[{"name":"redhat","role":"CNA","organizationId":"53f830b8-0a3f-465b-8143-3b8a9948e749","modified":"2026-10-30T17:59:41.041Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T19:20:39.082Z"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-119777","tags":["vdb-entry","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2564164","tags":["issue-tracking","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11241","tags":[],"source":"redhat"}],"weaknesses":[{"id":"CWE-787","description":"Out-of-bounds Write","source":"redhat"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T19:16:55.995158Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: stack buffer overflow in h.266/vvc parser","titleSource":"redhat","descriptionSource":"redhat","description":"A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow. An attacker could cause an application to crash and may be able to execute code in the context of the affected application.","score":7.8,"severity":"high","published":"2026-10-30T17:59:41.041Z","modified":"2026-10-30T19:20:39.082Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 10","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/o:redhat:enterprise_linux:10"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-119777"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 7","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/o:redhat:enterprise_linux:7"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-119777"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 8","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/o:redhat:enterprise_linux:8"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-119777"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 9","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/o:redhat:enterprise_linux:9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-119777"}],"remediation":[{"text":"There is no complete mitigation for this vulnerability. As a risk-reduction measure, disable H.266/VVC media ingestion in GStreamer-based applications and media pipelines where that feature is not required. Until a fixed package is available, do not open or transcode H.266/VVC files or streams from untrusted sources.","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-119777"}],"references":["https://access.redhat.com/security/cve/CVE-2026-119777","https://bugzilla.redhat.com/show_bug.cgi?id=2564164","https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11241"],"sources":[{"name":"CVE","id":"CVE-2026-119777","modified":"2026-10-30T19:20:39.082Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-119777"}],"assessments":[{"source":"redhat","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.8}],"sourceAffected":[],"observedAt":"2026-10-30T19:39:47.908Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:10:32.801Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T18:30:38.000Z","attemptedAt":"2026-10-30T18:30:38.000Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T18:30:37.575Z","attemptedAt":"2026-10-30T18:30:37.575Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-10-30T18:30:39.052Z","attemptedAt":"2026-10-30T18:30:39.052Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T18:30:36.517Z","attemptedAt":"2026-10-30T18:30:36.517Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-119777","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119777","modified":"2026-10-30T18:17:27.540","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","checkedAt":"2026-10-30T18:30:38.000Z"}],"aiSummary":{"text":"A stack buffer overflow in GStreamer's H.266/VVC parser may cause an application to crash when processing a malformed media file or stream. The vulnerability is due to an integer overflow while parsing profile, tier, and level fields. An attacker may be able to execute code in the context of the affected application.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T05:26:18.718Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-119777"}]}}