gst-plugins-bad EUVD-2026-38607

Exploitation requires that gst-plugins-bad is installed on the target RHEL system and that the victim actively opens a specially crafted H.264 video file (UI:R) containing malformed MVC (Multi-View Coding) or SVC (Scalable Video Coding) extension slice NAL units with insufficient data beyond the extension header. The attack is local (AV:L): the attacker cannot trigger parsing directly over the network and must rely on social engineering to deliver the file and induce the user to open it. No authentication is required of the attacker (PR:N), but user interaction is mandatory and non-bypassable. The impact is further constrained because the read is exactly 1 byte, the attacker has no control over which heap byte is read, and observing the leaked value requires additional mechanisms. Standard H.264 files without MVC or SVC extension NAL units will not trigger the flaw.

The CVSS 3.1 score of 4.4 (Medium) is broadly accurate and is supported by the available signals. The local attack vector (AV:L) and mandatory user interaction (UI:R) are the dominant risk-reduction factors - the attacker cannot trigger parsing remotely without relying on social engineering to deliver and cause the victim to open the file. The impact ceiling is low: confidentiality exposure is bounded to a single heap byte (C:L), there is no integrity impact (I:N), and availability impact is limited to application crash (A:L). The vulnerability is not listed in CISA KEV, and no proof-of-concept exploit code is identified in the provided intelligence, indicating no confirmed or widespread active exploitation. EPSS data is not available in the provided intelligence and cannot be assessed here. The absence of KEV listing, the narrow OOB read primitive, and the attacker's limited ability to control or observe the leaked byte collectively place this firmly in the moderate-priority patch queue rather than an emergency response category. The tags suggest both Information Disclosure and Buffer Overflow classification, but the description confirms this is a read-only 1-byte overread, not a write primitive - treat Buffer Overflow tagging as an imprecise CNA categorization.

An attacker crafts a malicious H.264 video file embedding a malformed MVC or SVC extension slice NAL unit with a truncated payload, then distributes it via a phishing email, malicious website, or messaging platform. When a victim on an affected RHEL system opens the file in a GStreamer-backed media player (such as Totem, Rhythmbox, or a browser with GStreamer integration), the H.264 parser reads 1 byte past the NAL unit boundary, potentially crashing the application or exposing a single heap byte. No public proof-of-concept has been identified, making this scenario contingent on an attacker with sufficient H.264 bitstream format knowledge.