CLEANSTART-2025-UJ27530 GStreamer AV1 Codec Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Security vulnerability affects the gst-plugins-bad package. GStreamer AV1 Codec Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability...

Fedora 45 : baresip / libre (2026-563e1454d9)

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-563e1454d9 advisory. Baresip v4.12.0 2026-09-30 - Feature: Send Custom X-Headers on Outbound Calls - audio: thread-safe usage of psize and ptime in txthread - jbuf: safer jbufset...

CVE-2026-119729

A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker...

CVE-2026-119729

A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker...

CVE-2026-119729 Gst-plugins-base: gst-plugins-bad: gst-plugins-base/gst-plugins-bad: integer overflow in av1 leb128 parser allows denial of service

A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker...

CVE-2026-119729 Gst-plugins-base: gst-plugins-bad: gst-plugins-base/gst-plugins-bad: integer overflow in av1 leb128 parser allows denial of service

A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker...

CVE-2026-119729

A vulnerability exists in GStreamer (specifically within gst-plugins-base/gst-plugins-bad ) due to an integer overflow in the AV1 LEB128 variable-length integer parser. A remote attacker can trigger this flaw by providing a malformed AV1 bitstream containing an invalid LEB128-encoded value. This ...

EUVD-2026-114319

A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker...

ab-av1-0.11.7-1.1 on GA media (moderate)

ab-av1-0.11.7-1.1 on GA media Announcement ID: openSUSE-SU-2026:12171-1 Rating: moderate Cross-References: CVE-2025-55159 CVSS scores: CVE-2025-55159 SUSE : 5.8 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H CVE-2025-55159 SUSE : 5.8 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N...

PT-2026-133770

Name of the Vulnerable Software and Affected Versions GStreamer affected versions not specified Description An integer overflow exists in the AV1 LEB128 variable-length integer parser. A remote attacker can cause a denial of service by providing a malformed AV1 bitstream containing an invalid...

CVE-2026-119729: Red Hat, GStreamer project: A flaw was found in GStreamer

A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker...

Linux Distros Unpatched Vulnerability : CVE-2026-119729

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in...

CVE-2026-114112

A flaw was found in sharp. An attacker can exploit this vulnerability by submitting specially crafted AV1 Image File Format AVIF or High-Efficiency Image File Format HEIF images to applications processing untrusted media. Due to memory corruption during image decoding in a bundled library,...

Fedora 44 : baresip / libre (2026-9931bf2b85)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-9931bf2b85 advisory. Baresip v4.12.0 2026-09-30 - Feature: Send Custom X-Headers on Outbound Calls - audio: thread-safe usage of psize and ptime in txthread - jbuf: safer jbufset...

Fedora 43 : baresip / libre (2026-ff2a4f31ce)

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-ff2a4f31ce advisory. Baresip v4.12.0 2026-09-30 - Feature: Send Custom X-Headers on Outbound Calls - audio: thread-safe usage of psize and ptime in txthread - jbuf: safer jbufset...

PT-2026-117597

These are all security issues fixed in the ab-av1-0.11.7-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:12171-1 ab-av1-0.11.7-1.1 on GA media

These are all security issues fixed in the ab-av1-0.11.7-1.1 package on the GA media of openSUSE Tumbleweed...

Linux Distros Unpatched Vulnerability : CVE-2026-107676

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when...

SUSE CVE-2026-107676

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when tonemappingflag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcodin...

Use of Uninitialized Resource

Overview Affected versions of this package are vulnerable to Use of Uninitialized Resource in the avdynamichdrplustot35 function when processing HDR10+ metadata. An attacker can access sensitive process memory by supplying crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata, causing...