GStreamer CVE-2026-119777

Exploitation requires an application built on GStreamer's gst-plugins-bad with the H.266/VVC parser to process an attacker-crafted, malformed H.266/VVC media file or stream; the integer overflow occurs specifically while parsing the profile, tier, and level (PTL) fields. Per the CVSS vector (AV:L, UI:R, PR:N), it is local and requires user interaction - a victim must open or play the malicious media in a vulnerable application - and no authentication is needed once the file is processed. Limiting factors: the vulnerable VVC parser plugin must be present and invoked, exploitation is not network-remote without user action, and code execution is described as a possibility ('may be able to'), not a confirmed reliable outcome, so platform mitigations (stack canaries, ASLR) may reduce reliability.

The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) rates this High, but the real-world risk is tempered by the local attack vector and required user interaction: an application must be made to process an attacker-supplied H.266/VVC file or stream, so this is not a remotely-triggerable, zero-click flaw. No PR is needed once the file is opened, and impact is full confidentiality/integrity/availability within the process context, consistent with a CWE-787 stack buffer overflow that may yield code execution. Several signals are MISSING: no EPSS probability is provided, so likelihood of exploitation cannot be quantified; there is no CISA KEV listing and no SSVC exploitation/automatable breakdown beyond the vuln.today 'this_week' priority. There is a notable description/vector nuance to verify: the description mentions a malformed 'stream', which can read as network-delivered, yet the CVSS vector is AV:L with UI:R - indicating the data must be processed locally (e.g., a file opened by the user) rather than exploited directly over the network; treat this as local/file-borne unless the vendor states otherwise. Overall this is a genuine memory-corruption bug worth remediating on the vendor's 'this_week' cadence, but the UI:R/AV:L profile and absence of KEV/EPSS/PoC signals place it below emergency, targeted-mass-exploitation tier.

An attacker crafts a malformed H.266/VVC media file (or a stream processed by a local application) that triggers an integer overflow in the profile/tier/level parsing of GStreamer's gst-plugins-bad VVC parser. When a victim opens or plays the file in an application that uses the vulnerable plugin, the resulting stack-based buffer overflow crashes the application and may allow code execution in that application's context. No public exploit identified at time of analysis.