{
  "cveId": "CVE-2026-12892",
  "url": "https://patchblox.com/security/cve/CVE-2026-12892",
  "summary": "CVE-2026-12892 is fixed in 10 products on 1 platform, first by SUSE-SU-2026:3058-1, released July 15, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "gst-plugins-bad1.0: A flaw was found in GStreamer\u0027s gst-plugins-bad package",
  "description": "A flaw was found in GStreamer\u0027s gst-plugins-bad package. When processing a specially crafted H.264 video file containing malformed MVC or SVC extension slice NAL units, a 1-byte heap out-of-bounds read can occur during parsing. This happens when the parser attempts to check slice boundary information without first verifying that the NAL unit contains enough data beyond the extension header. An attacker could exploit this by tricking a user into opening a malicious H.264 video file, potentially causing the application to crash or leak a single byte of heap memory.",
  "published": "2026-06-23T21:16:55Z",
  "severity": "medium",
  "cvss": 4.4,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
  "epss": 0.00157,
  "epssPercentile": 0.04927,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "gst-plugins-bad1.0",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "1.22.0-4\u002Bdeb12u8",
      "fix": "DEBIAN-CVE-2026-12892",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-12892",
      "released": "2026-07-22T13:15:29Z"
    },
    {
      "platform": "linux",
      "product": "gst-plugins-bad1.0",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1.26.2-3\u002Bdeb13u3",
      "fix": "DEBIAN-CVE-2026-12892",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-12892",
      "released": "2026-07-22T13:15:29Z"
    },
    {
      "platform": "linux",
      "product": "gst-plugins-bad1.0",
      "release": "Debian 14",
      "fixedVersion": "1.28.5-1",
      "fix": "DEBIAN-CVE-2026-12892",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-12892",
      "released": "2026-07-22T13:15:29Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer-plugins-bad",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "1.26.7-160000.3.1",
      "fix": "OPENSUSE-SU-2026:21370-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21370-1",
      "released": "2026-07-18T06:18:17Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer-plugins-bad",
      "release": "sles 15.6",
      "fixedVersion": "1.24.0-150600.4.9.1",
      "fix": "SUSE-SU-2026:3058-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3058-1",
      "released": "2026-07-15T13:32:27Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer-plugins-bad",
      "release": "sles 15.7",
      "fixedVersion": "1.24.0-150600.4.9.1",
      "fix": "SUSE-SU-2026:3058-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3058-1",
      "released": "2026-07-15T13:32:27Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer-plugins-bad",
      "release": "sles 16.0",
      "fixedVersion": "1.26.7-160000.3.1",
      "fix": "SUSE-SU-2026:22817-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-22817-1",
      "released": "2026-07-18T06:19:25Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugin-openh264",
      "release": "amzn 2023",
      "fixedVersion": "1.24.10-1.amzn2023.0.8",
      "fix": "ALAS2023-2026-1994",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1994",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugin-openh264-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.24.10-1.amzn2023.0.8",
      "fix": "ALAS2023-2026-1994",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1994",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-bad-free",
      "release": "amzn 2023",
      "fixedVersion": "1.24.10-1.amzn2023.0.8",
      "fix": "ALAS2023-2026-1994",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1994",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-bad-free-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.24.10-1.amzn2023.0.8",
      "fix": "ALAS2023-2026-1994",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1994",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-bad-free-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "1.24.10-1.amzn2023.0.8",
      "fix": "ALAS2023-2026-1994",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1994",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-bad-free-devel",
      "release": "amzn 2023",
      "fixedVersion": "1.24.10-1.amzn2023.0.8",
      "fix": "ALAS2023-2026-1994",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1994",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-bad-free-libs",
      "release": "amzn 2023",
      "fixedVersion": "1.24.10-1.amzn2023.0.8",
      "fix": "ALAS2023-2026-1994",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1994",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-bad-free-libs-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.24.10-1.amzn2023.0.8",
      "fix": "ALAS2023-2026-1994",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1994",
      "released": "2026-08-03T09:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}