CVE-2026-119727 A flaw was found in GStreamer's gst-plugins-bad H.265 video parser.
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-119727?
CVE-2026-119727 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, published on 30 Oct 2026.
Official description
A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the parser to accept an out-of-range value for the number of palette predictor entries. This causes the parser to write beyond the end of a fixed-size array, resulting in memory corruption and an application crash. An attacker can deliver the malformed bitstream as a local file or over a network stream such as HTTP, HLS, DASH, RTSP, RTP, or WebRTC. Successful exploitation requires the application to open or play that content, and is limited to a denial-of-service impact.
Weakness: CWE-122
Which versions are affected by CVE-2026-119727?
How do I fix CVE-2026-119727?
Upgrade to a fixed version.
Is CVE-2026-119727 being exploited?
There is no known exploitation of CVE-2026-119727 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-119727, ECHO-d865-cc59-d6ce, GHSA-x42f-f245-m897, UBUNTU-CVE-2026-119727.