EUVD-2026-114325 flags H.265 parser flaw in GStreamer gst-plugins-bad
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- GStreamer
- Product
- gst-plugins-bad
- First seen
Summary
EUVD-2026-114325 describes an integer underflow in the H.265 parser of GStreamer's gst-plugins-bad, rated 6.5 (CVSS v3.1). Per the record, a specially crafted H.265 bitstream with certain SCC palette settings can trigger it.
If you use GStreamer
Update gst-plugins-bad to a release that includes the upstream fix
Avoid opening untrusted H.265 media until patched
Check downstream applications that bundle GStreamer
Update gst-plugins-base to a release that includes the upstream fix
Avoid opening untrusted subtitle files until patched
Update gst-plugins-bad to a patched release once your distribution ships one
What the sources say 5
· Mastodon: “A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser.” Source
· Mastodon: “A flaw was found in GStreamer's gst-plugins-bad H.265 video parser.” Source
· Mastodon: “A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser.” Source
· Mastodon: “A flaw was found in GStreamer.” Source
· Mastodon: “A flaw was found in the H.264 video parser in gst-plugins-bad.” Source