{"id":"CVE-2026-121611","published":"2026-11-09T13:17:07.060","lastModified":"2026-11-10T18:17:20.500","description":"A flaw was found in GStreamer's gst-plugins-bad package. A use of uninitialized memory vulnerability exists in the H.265 (HEVC) bitstream parser when processing Video Parameter Sets that declare more than one HRD (Hypothetical Reference Decoder) parameter set. A remote attacker could exploit this by providing a crafted H.265 media file or stream that, when processed by an application using GStreamer, causes unpredictable parser behavior and may crash the application. This can lead to a denial of service for any application using GStreamer to play back H.265 content.","cvssScore":6.5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cwes":["CWE-457"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-121611","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2565937","tags":[]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5332","tags":[]},{"url":"https://gstreamer.freedesktop.org/security/sa-2026-0094.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}