GStreamer gst-plugins-bad CVE-2026-12891

Exploitation requires the victim to actively open or process a crafted H.266/VVC video file or stream using an application built on GStreamer with the gst-plugins-bad H.266/VVC parser plugin loaded - this is the triggering condition (UI:R). The flaw is specifically in the aspect ratio indicator parsing path of the H.266 parser; only media files or streams that include a manipulated aspect ratio indicator value in the bitstream header trigger the vulnerable code. No authentication is required from the attacker (PR:N), and no special server-side configuration is needed beyond the gst-plugins-bad package being installed and H.266 content being processed. Exploitation is limited by: the requirement for victim interaction (opening the file), the narrow 8-byte read window which constrains the volume of leaked data per trigger, and the fact that the read does not produce a crash, making exploitation feedback-limited without an oracle. H.266/VVC is a newer codec, so applications lacking VVC support are not affected even with gst-plugins-bad installed.

The NVD CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) accurately captures the key risk dimensions: the attack is network-reachable with low complexity and no authentication, but requires the victim to open or play the crafted file (UI:R), and the confidentiality impact is limited to a narrow 8-byte window (C:L) with no integrity or availability consequence. There is no EPSS value present in the provided data, so exploitation probability cannot be quantified. No CISA KEV listing exists, and no POC is referenced - exploitation remains theoretical. The combination of UI:R, minimal data leakage (8 bytes), and no scope change makes this a low-priority patching item for most environments; however, organizations processing untrusted H.266/VVC media streams at scale (transcoding pipelines, media ingest services) face a modestly higher risk due to repeated exposure. No conflict between CVSS signals and description is observed - the network vector is consistent with file-delivery via web or email rather than direct socket exploitation.

An attacker crafts a malformed H.266/VVC video file in which the aspect ratio indicator field is set to a value that causes the GStreamer parser to read 8 bytes past the intended buffer boundary. The attacker delivers this file to a target user via email attachment, a malicious website, or an embedded media stream. When the victim opens the file in any GStreamer-based application (a desktop media player, a browser with GStreamer backend, or a server-side transcoder), the OOB read occurs and up to 8 bytes of the application's adjacent heap or stack memory may be exposed through video metadata, potentially revealing pointer values, partial keys, or other sensitive runtime data. No POC has been identified at time of analysis.