{"id":"CVE-2026-121611","aliases":[],"cve":{"records":[{"id":"CVE-2026-121611","source":"redhat","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-03T16:32:50.045Z","published":"2026-11-09T13:01:00.326Z","modified":"2026-11-10T17:51:12.207Z"}],"publishers":[{"name":"redhat","role":"CNA","organizationId":"53f830b8-0a3f-465b-8143-3b8a9948e749","modified":"2026-11-09T13:01:00.326Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-10T17:51:12.207Z"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-121611","tags":["vdb-entry","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2565937","tags":["issue-tracking","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5332","tags":[],"source":"redhat"},{"url":"https://gstreamer.freedesktop.org/security/sa-2026-0094.html","tags":[],"source":"redhat"}],"weaknesses":[{"id":"CWE-457","description":"Use of Uninitialized Variable","source":"redhat"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-10T15:42:47.360220Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Gstreamer1-plugins-bad-free: gst-plugins-bad: use of uninitialized gsth265hrdparams in gst_h265_parse_vps() multi-hrd workaround loop","titleSource":"redhat","descriptionSource":"redhat","description":"A flaw was found in GStreamer's gst-plugins-bad package. A use of uninitialized memory vulnerability exists in the H.265 (HEVC) bitstream parser when processing Video Parameter Sets that declare more than one HRD (Hypothetical Reference Decoder) parameter set. A remote attacker could exploit this by providing a crafted H.265 media file or stream that, when processed by an application using GStreamer, causes unpredictable parser behavior and may crash the application. This can lead to a denial of service for any application using GStreamer to play back H.265 content.","score":6.5,"severity":"medium","published":"2026-11-09T13:01:00.326Z","modified":"2026-11-10T17:51:12.207Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 10","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:enterprise_linux:10"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-121611"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 7","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/o:redhat:rhel_els:7"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-121611"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 8","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:enterprise_linux:8"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-121611"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 9","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:enterprise_linux:9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-121611"}],"remediation":[{"text":"No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-121611"}],"references":["https://access.redhat.com/security/cve/CVE-2026-121611","https://bugzilla.redhat.com/show_bug.cgi?id=2565937","https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5332","https://gstreamer.freedesktop.org/security/sa-2026-0094.html"],"sources":[{"name":"CVE","id":"CVE-2026-121611","modified":"2026-11-10T17:51:12.207Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-121611"}],"assessments":[{"source":"redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","score":6.5}],"sourceAffected":[],"observedAt":"2026-11-10T18:17:01.372Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T03:15:35.363Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-09T13:35:36.330Z","attemptedAt":"2026-11-09T13:35:36.330Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-09T13:35:36.036Z","attemptedAt":"2026-11-09T13:35:36.036Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-09T13:35:36.652Z","attemptedAt":"2026-11-09T13:35:36.652Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-09T13:35:37.316Z","attemptedAt":"2026-11-09T13:35:37.316Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-121611","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121611","modified":"2026-11-09T13:17:07.180","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","checkedAt":"2026-11-09T13:35:36.330Z"}],"aiSummary":{"text":"A use of uninitialized memory vulnerability exists in GStreamer's gst-plugins-bad package when processing H.265 Video Parameter Sets with multiple HRD parameter sets. A remote attacker could exploit this by providing a crafted H.265 media file. This may cause unpredictable parser behavior and crash the application.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-09T13:21:05.385Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-121611"}]}}