CVE-2026-119727 Gst-plugins-bad: gst-plugins-bad: h.265 sps scc palette predictor array overflow via integer underflow in bounds computation

Description

A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the parser to accept an out-of-range value for the number of palette predictor entries. This causes the parser to write beyond the end of a fixed-size array, resulting in memory corruption and an application crash. An attacker can deliver the malformed bitstream as a local file or over a network stream such as HTTP, HLS, DASH, RTSP, RTP, or WebRTC. Successful exploitation requires the application to open or play that content, and is limited to a denial-of-service impact.

Exploitable remotely over the network, without an account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector

Network

Attack complexity

Low

Privileges required

None

Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected products and versions