Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119727— Gst-plugins-bad: gst-plugins-bad: h.265 sps scc palette predictor array overflow via integer underflow in bounds computation

Quick assessment

Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 GStreamer 的 组件中的 H.265 视频解析器中发现了一个漏洞。当解析一个特制的 H.265 比特流，且该比特流包含屏幕内容编码（SCC）扩展并设置了特定的调色板预测器初始化参数时，由于上界计算过程中发生整数下溢，解析器会接受一个超出范围的调色板预测器条目数量。这导致解析器向固定大小数组的末尾之外写入数据，从而引发内存损坏并造成应用程序崩溃。成功利用该漏洞需要攻击者向存在漏洞的应用程序提供恶意的 H.265 媒体文件，其影响范围仅限于拒绝服务（DoS）。

CVSS 6.5 · Medium

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 4

VendorProduct Version RangeStatus
Red Hat Red Hat Enterprise Linux 10 any affected
Red Hat Red Hat Enterprise Linux 7 any unaffected
Red Hat Red Hat Enterprise Linux 8 any unaffected
Red Hat Red Hat Enterprise Linux 9 any affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119727

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Gst-plugins-bad: gst-plugins-bad: h.265 sps scc palette predictor array overflow via integer underflow in bounds computation
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the parser to accept an out-of-range value for the number of palette predictor entries. This causes the parser to write beyond the end of a fixed-size array, resulting in memory corruption and an application crash. Successful exploitation requires an attacker to provide a malformed H.265 media file to a vulnerable application, and is limited to a denial-of-service impact.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
堆缓冲区溢出
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat Enterprise Linux 10 - cpe:/o:redhat:enterprise_linux:10
Red Hat Red Hat Enterprise Linux 7 - cpe:/o:redhat:enterprise_linux:7
Red Hat Red Hat Enterprise Linux 8 - cpe:/o:redhat:enterprise_linux:8
Red Hat Red Hat Enterprise Linux 9 - cpe:/o:redhat:enterprise_linux:9

II. Public POCs for CVE-2026-119727

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119727

请登录查看更多情报信息。

Other References for CVE-2026-119727 (4)

Same Patch Batch · Red Hat · 2026-10-30 · 20 CVEs total

CVE-2026-119777 7.8 HIGH Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: stack buffer overflow in h.266/v
CVE-2026-119528 7.8 HIGH Gimp: gimp: stack buffer overflow in psd image resource header loader
CVE-2026-103963 7.5 HIGH Glib-networking: unbounded tls 1.3 session ticket queue growth in glib-networking allows r
CVE-2026-119729 6.5 MEDIUM Gst-plugins-base: gst-plugins-bad: gst-plugins-base/gst-plugins-bad: integer overflow in a
CVE-2026-91920 6.5 MEDIUM Undertow: undertow: chunkreader message length permits chunk-size overflow
CVE-2026-118952 6.5 MEDIUM Kroxylicious-authorizer-acl: kroxylicious: acl prefix matching can bypass authorization ru
CVE-2026-115455 6.5 MEDIUM Gcc: stack overflow in std::bitset on libstdc++
CVE-2026-119842 6.5 MEDIUM Gst-plugins-base: gst-plugins-base: null-pointer dereference in mdvdsub subtitle parser vi
CVE-2026-114690 6.2 MEDIUM Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std
CVE-2026-114691 5.9 MEDIUM Gcc: integer wrap in `std
CVE-2026-118593 5.9 MEDIUM Kernel: local_bh imbalance in seg6_input_core() drop path (incomplete fix for cve-2026-460
CVE-2026-110133 5.8 MEDIUM Ghostscript: heap buffer overflow in ghostscript truetype outliner due to npointstotal int
CVE-2026-119728 5.5 MEDIUM Gst-plugins-bad: gst-plugins-bad: null pointer dereference in h.264 mvc sps cleanup during
CVE-2026-118959 5.4 MEDIUM Keycloak-services: keycloak-services: required actions bypassed via kc_action parameter
CVE-2026-119542 4.3 MEDIUM Org.infinispan/infinispan-query: infinispan: deeply nested ickle queries can trigger a sta
CVE-2026-118947 4.3 MEDIUM Keycloak-services: keycloak-services: authorization bypass via uma resource registration i
CVE-2026-115456 3.7 LOW Gcc: out-of-bounds read in std::from_chars
CVE-2026-118475 3.6 LOW Eog: eye of gnome: buffer overrun when parsing malicious png files with non-standard iccp
CVE-2026-112922 3.3 LOW Ghostscript: out-of-bounds read in ghostscript shade_next_color via integer overflow of in

IV. Related Vulnerabilities

Same product: Red Hat Enterprise Linux 10
Same vendor: Red Hat
Same weakness: CWE-122