CVE-2026-119729 A flaw was found in GStreamer.
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-119729?
CVE-2026-119729 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, published on 30 Oct 2026.
Official description
A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker can cause integer overflow in the parser, resulting in incorrect length values being used during stream processing, which can lead to a denial of service.
Weakness: CWE-190
Which versions are affected by CVE-2026-119729?
How do I fix CVE-2026-119729?
Upgrade to a fixed version.
Is CVE-2026-119729 being exploited?
There is no known exploitation of CVE-2026-119729 in the wild and no public exploit code.
Sources
Also known as AZL-112663, DEBIAN-CVE-2026-119729, ECHO-c749-4cff-3073, GHSA-q73j-x4hx-9236, UBUNTU-CVE-2026-119729.