GStreamer gst-plugins-bad EUVD-2026-114325

Exploitation requires a victim to open or process an attacker-supplied, specially crafted H.265 bitstream that contains a Screen Content Coding (SCC) extension with palette predictor initializer settings that trigger the integer underflow in the upper-bound computation for the number of palette predictor entries, using an application that relies on GStreamer's gst-plugins-bad H.265 parser. Limiting factors: exploitation is not fully automatic - UI:R means the user must actively open/play the malicious media; the affected gst-plugins-bad H.265 parser must be present and invoked to handle the file; and impact is bounded to a crash (denial of service) with no confidentiality or integrity effect per the vendor description.

This is a moderate-severity, DoS-only issue that should be patched on a routine cycle rather than treated as an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5) tells a consistent story: network-reachable in the sense that a malicious file can be delivered remotely, low complexity, no privileges required, but user interaction (UI:R) is mandatory because a victim must open or process the crafted H.265 media, and the only impact is availability (application crash) - no confidentiality or integrity loss. The vuln.today decision label is 'this_month', not act_now or emergency, which aligns with a memory-corruption bug whose realistic outcome is limited to a crash. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. There is no CISA KEV listing and no public exploit identified at time of analysis; the only code reference is the upstream fix (GStreamer merge request 10902), not a weaponized PoC. CWE-122 (heap-based buffer overflow) can in principle imply code-execution potential, but Red Hat's description explicitly scopes the impact to denial-of-service, so the A:H-only rating should be respected rather than inflated. Net: real but non-urgent - a legitimate this-month patch item, not a high-CVSS-but-hollow finding, yet also not a drop-everything priority given DoS-only impact and required user interaction.

An attacker crafts an H.265 video file whose Screen Content Coding (SCC) extension carries palette predictor initializer settings that trigger an integer underflow in the parser's upper-bound check. The attacker distributes this file (email attachment, web download, media share) to a victim running an application built on GStreamer's gst-plugins-bad H.265 parser; when the victim opens or previews it, the parser writes past a fixed-size array and the application crashes. No public exploit code has been identified, and the outcome is limited to denial of service.