Answer in brief
CVE-2026-119729 records a Medium severity (CVSS 6.5) vulnerability in Gst-plugins-base: gst-plugins-bad: gst-plugins-base/gst-plugins-bad: integer overflow in av1 leb128 parser allows denial of service. The current sources do not mark it as known exploited. The current feed maps Red Hat/gstreamer1-plugins-bad-free (generic), Red Hat/gstreamer1-plugins-base (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Red Hat/gstreamer1-plugins-bad-free (generic), Red Hat/gstreamer1-plugins-base (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Red Hat/gstreamer1-plugins-bad-freegeneric | * | Not reported |
| Red Hat/gstreamer1-plugins-basegeneric | * | Not reported |
Published upstream
Oct 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 30, 2026
A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker can cause integer overflow in the parser, resulting in incorrect length values being used during stream processing, which can lead to a denial of service.
Quoted source text, attributed separately from HOL analysis.