{"affected":[{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-121611","cwes":["CWE-457"],"description":"A flaw was found in GStreamer's gst-plugins-bad package. A use of uninitialized memory vulnerability exists in the H.265 (HEVC) bitstream parser when processing Video Parameter Sets that declare more than one HRD (Hypothetical Reference Decoder) parameter set. A remote attacker could exploit this by providing a crafted H.265 media file or stream that, when processed by an application using GStreamer, causes unpredictable parser behavior and may crash the application. This can lead to a denial of service for any application using GStreamer to play back H.265 content.","epss":{"date":"2026-11-10","percentile":0.4715,"score":0.00563},"exploits":[],"kev":null,"metrics":[{"score":6.5,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},{"score":6.5,"severity":"medium","source":"NVD: secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1794333072207,"publishedAt":1794229260326,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-121611"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2565937"},{"source":"CNA: redhat","tags":[],"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5332"},{"source":"CNA: redhat","tags":[],"url":"https://gstreamer.freedesktop.org/security/sa-2026-0094.html"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/security/cve/CVE-2026-121611"},{"source":"secalert@redhat.com","tags":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2565937"},{"source":"secalert@redhat.com","tags":[],"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5332"},{"source":"secalert@redhat.com","tags":[],"url":"https://gstreamer.freedesktop.org/security/sa-2026-0094.html"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability."}],"revision":"a60d5f9e9af05b7c827aaa833cc59c18a044b9e17dac3b89375490eadc14cca4","sources":[{"modifiedAt":1794333072207,"name":"CNA: redhat","retrievedAt":1794334160581,"url":"https://www.cve.org/CVERecord?id=CVE-2026-121611"},{"modifiedAt":1794230227180,"name":"NVD","retrievedAt":1794248347063,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121611"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794334199842,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-121611"}],"ssvc":{"assessedAt":1794325367360,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Gstreamer1-plugins-bad-free: gst-plugins-bad: use of uninitialized gsth265hrdparams in gst_h265_parse_vps() multi-hrd workaround loop","updatedAt":1794334199842}