Is CVE-2026-119727 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119727 being exploited in the wild.

How severe is CVE-2026-119727?

Medium severity, with a CVSS score of 6.5, published 30 October 2026.

Which products and versions are affected?

Gstreamer Gst-Plugins-Bad before 1.28.1.

Is there a fix for CVE-2026-119727?

Yes: fixed in gst-plugins-bad 1.28.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-119727 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-119727?

Check whether you run Gstreamer Gst-Plugins-Bad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119727: GStreamer gst-plugins-bad H.265 parser buffer overflow

CVE-2026-119727 · Severity: medium · CVSS 6.5 · Published 2026-10-30

GStreamer's video plugin for parsing H.265 video streams contains a flaw that allows a specially crafted video file to crash an application. An attacker can trigger a denial-of-service by providing a malformed H.265 media file that the vulnerable plugin attempts to parse, causing memory corruption and application crash.

Technologies: Gstreamer Gst-Plugins-Bad. Vendors: Gstreamer.

Quick answers

Is CVE-2026-119727 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119727 being exploited in the wild.
How severe is CVE-2026-119727?: Medium severity, with a CVSS score of 6.5, published 30 October 2026.
Which products and versions are affected?: Gstreamer Gst-Plugins-Bad before 1.28.1.
Is there a fix for CVE-2026-119727?: Yes: fixed in gst-plugins-bad 1.28.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119727 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-119727?: Check whether you run Gstreamer Gst-Plugins-Bad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: gst-plugins-bad 1.28.1

Technical details

An integer underflow in the H.265 Screen Content Coding (SCC) palette predictor initializer bounds computation allows out-of-range values to be accepted, leading to a heap-based buffer overflow when writing palette predictor entries. The vulnerability requires a user to open a crafted H.265 bitstream; exploitation results in application crash (DoS) with no confidentiality or integrity impact.

Affected products

GStreamer gst-plugins-bad before 1.28.1

Timeline

2026-10-30: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.