PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-12891 Red Hat CVE debrief

The GStreamer gst-plugins-bad package has a flaw that allows an attacker to craft a malicious H.266 video file or stream. When processed by a GStreamer-based application, it could leak limited memory contents through video metadata, potentially exposing sensitive information from the application's address space. The flaw is caused by an out-of-bounds read of up to 8 bytes from adjacent memory when processing a malformed H.266/VVC video stream with a crafted aspect ratio indicator value. The Common Vulnerabilities and Exposures (CVE) score for this vulnerability is 4.3, with a Medium severity rating. The CVE was published on June 23, 2026, and modified on June 25, 2026.

Vendor
Red Hat
Product
Red Hat Enterprise Linux 10
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-23
Original CVE updated
2026-07-01
Advisory published
2026-06-23
Advisory updated
2026-07-01

Who should care

Developers and administrators using the GStreamer gst-plugins-bad package should be aware of this vulnerability and take necessary precautions. This vulnerability could potentially expose sensitive information from the application's address space. GStreamer-based applications that process H.266 video files or streams are at risk.

Technical summary

The GStreamer gst-plugins-bad package has a flaw in the H.266 parser that performs an out-of-bounds read of up to 8 bytes from adjacent memory when processing a malformed H.266/VVC video stream with a crafted aspect ratio indicator value. This flaw allows an attacker to craft a malicious H.266 video file or stream that, when processed by a GStreamer-based application, could leak limited memory contents through video metadata. The vulnerability has a CVSS score of 4.3 and a Medium severity rating. The flaw is classified under CWE-125.

Defensive priority

Medium priority should be given to patching this vulnerability, as it could potentially expose sensitive information. Administrators should prioritize patching based on the sensitivity of the information processed by GStreamer-based applications.

Recommended defensive actions

  • Patch GStreamer gst-plugins-bad package to the latest version
  • Restrict access to GStreamer-based applications that process H.266 video files or streams
  • Monitor GStreamer-based applications for suspicious activity
  • Implement compensating controls to detect and prevent potential memory leaks
  • Perform thorough inventory checks to identify affected systems

Evidence notes

The CVE-2026-12891 vulnerability was published on June 23, 2026, and modified on June 25, 2026. The vulnerability is classified under CWE-125. The CVSS score is 4.3, with a Medium severity rating. Limited information is available about the affected scope and vendor remediation workflow.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-12891 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-12891

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-12891 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-12891

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.