PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-12892 Red Hat CVE debrief

A flaw was found in GStreamer's gst-plugins-bad package. When processing a specially crafted H.264 video file containing malformed MVC or SVC extension slice NAL units, a 1-byte heap out-of-bounds read can occur during parsing. This happens when the parser attempts to check slice boundary information without first verifying that the NAL unit contains enough data beyond the extension header. An attacker could exploit this by tricking a user into opening a malicious H.264 video file, potentially causing the application to crash or leak a single byte of heap memory. The vulnerability has a CVSS score of 4.4 and is classified as MEDIUM severity. The CVE was published on June 23, 2026, and modified on June 25, 2026.

Vendor
Red Hat
Product
Red Hat Enterprise Linux 10
CVSS
MEDIUM 4.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-23
Original CVE updated
2026-06-25
Advisory published
2026-06-23
Advisory updated
2026-06-25

Who should care

Users of GStreamer's gst-plugins-bad package should be aware of this vulnerability and take steps to mitigate it. This includes updating to a patched version of the package and being cautious when opening H.264 video files from untrusted sources. The vulnerability could potentially be used to cause a denial of service or leak sensitive information.

Technical summary

The vulnerability is caused by a 1-byte heap out-of-bounds read that occurs during parsing of specially crafted H.264 video files. This happens when the parser attempts to check slice boundary information without first verifying that the NAL unit contains enough data beyond the extension header. The vulnerability has a CVSS score of 4.4 and is classified as MEDIUM severity. The CVSS vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L. The weakness is classified as CWE-125.

Defensive priority

This vulnerability should be prioritized for remediation based on its MEDIUM severity and potential impact on affected systems. Users of GStreamer's gst-plugins-bad package should update to a patched version of the package as soon as possible.

Recommended defensive actions

  • Update to a patched version of GStreamer's gst-plugins-bad package
  • Be cautious when opening H.264 video files from untrusted sources
  • Implement additional security controls to detect and prevent exploitation
  • Monitor systems for potential exploitation attempts
  • Review and update incident response plans to address potential exploitation

Evidence notes

The CVE was published on June 23, 2026, and modified on June 25, 2026. The vulnerability is classified as CWE-125. The CVSS score is 4.4 and the severity is MEDIUM. The vulnerability could potentially be used to cause a denial of service or leak sensitive information.

Official resources

This article is AI-assisted and based on the supplied source corpus.