There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer
    parser allows a remote attacker to cause a crash in applications that process AV1 media content. By
    crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker can cause
    integer overflow in the parser, resulting in incorrect length values being used during stream processing,
    which can lead to a denial of service. (CVE-2026-119729)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - 在 GStreamer 中發現缺陷。AV1 LEB128 可變長度整數剖析器中的整數溢位弱點允許遠端攻擊者在處理 AV1 媒體內容的應用程式中造成當機。透過製作包含無效 LEB128編碼值的格式錯誤的 AV1 位元流，攻擊者可以在剖析器中造成整數溢位，導致在串流處理期間使用不正確的長度值，進而導致拒絕服務。（CVE-2026-119729）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 在 GStreamer 中发现一个缺陷。AV1 LEB128 可变长度整数解析器中的整数溢出漏洞允许远程攻击者造成处理 AV1 媒体内容的应用程序崩溃。攻击者可通过构建包含无效 LEB128-encoded 值的畸形 AV1 比特流，在解析器中造成整数溢出，从而导致在流处理期间使用不正确的长度值，从而导致拒绝服务。（CVE-2026-119729）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - GStreamer に欠陥が見つかりました。AV1 LEB128 可変長整数パーサーの整数オーバーフローの脆弱性により、リモートの攻撃者が、AV1 メディアコンテンツを処理するアプリケーションでクラッシュを引き起こす可能性があります。無効な LEB128 エンコード値を含む無効な形式の AV1 ビットストリームを細工することにより、攻撃者がパーサーで整数オーバーフローを引き起こし、ストリーム処理中に正しくない長さの値が使用されて、サービス拒否につながる可能性があります。(CVE-2026-119729)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer     parser allows a remote attacker to cause a crash in applications that process AV1 media content. By     crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker can cause     integer overflow in the parser, resulting in incorrect length values being used during stream processing,     which can lead to a denial of service. (CVE-2026-119729)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3424 advisory.

    A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265     bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer     settings, an integer underflow in the upper-bound computation allows the parser to accept an out-of-range     value for the number of palette predictor entries. This causes the parser to write beyond the end of a     fixed-size array, resulting in memory corruption and an application crash. Successful exploitation     requires an attacker to provide a malformed H.265 media file to a vulnerable application, and is limited     to a denial-of-service impact. (CVE-2026-119727)

    A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264     video file with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL     pointer during the cleanup of partially allocated internal structures after a parse failure. This can     cause the application using GStreamer to crash, resulting in a denial of service. (CVE-2026-119728)

    A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer     parser allows a remote attacker to cause a crash in applications that process AV1 media content. By     crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker can cause     integer overflow in the parser, resulting in incorrect length values being used during stream processing,     which can lead to a denial of service. (CVE-2026-119729)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of gstreamer1-plugins-bad-free installed on the remote host is prior to 1.18.4-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4094 advisory.

    A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265     bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer     settings, an integer underflow in the upper-bound computation allows the parser to accept an out-of-range     value for the number of palette predictor entries. This causes the parser to write beyond the end of a     fixed-size array, resulting in memory corruption and an application crash. Successful exploitation     requires an attacker to provide a malformed H.265 media file to a vulnerable application, and is limited     to a denial-of-service impact. (CVE-2026-119727)

    A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264     video file with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL     pointer during the cleanup of partially allocated internal structures after a parse failure. This can     cause the application using GStreamer to crash, resulting in a denial of service. (CVE-2026-119728)

    A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer     parser allows a remote attacker to cause a crash in applications that process AV1 media content. By     crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker can cause     integer overflow in the parser, resulting in incorrect length values being used during stream processing,     which can lead to a denial of service. (CVE-2026-119729)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
478112	Echo: gst-plugins-bad1.0: security update to 1.26.2-3+deb13u3+e3gst-plugins-base1.0: security update to 1.26.2-1+deb13u2+e1	Tenable Self-Hosted Container Security	Echo Local Security Checks	10/31/2026	11/2/2026	medium
478112	Echo: gst-plugins-bad1.0: security update to 1.26.2-3+deb13u3+e3gst-plugins-base1.0: security update to 1.26.2-1+deb13u2+e1	Tenable Cloud Security	Echo Local Security Checks	10/31/2026	11/2/2026	medium
374311	Linux Distros 未修補弱點：CVE-2026-119729	Nessus	Misc.	10/30/2026	10/31/2026	medium
374311	Linux Distros 未修补的漏洞：CVE-2026-119729	Nessus	Misc.	10/30/2026	10/31/2026	medium
374311	Linux Distros のパッチ未適用の脆弱性: CVE-2026-119729	Nessus	Misc.	10/30/2026	10/31/2026	medium
374311	Linux Distros Unpatched Vulnerability : CVE-2026-119729	Nessus	Misc.	10/30/2026	10/31/2026	medium
379874	Amazon Linux 2023 : gstreamer1-plugin-openh264, gstreamer1-plugins-bad-free, gstreamer1-plugins-bad-free-devel (ALAS2023-2026-3424)	Nessus	Amazon Linux Local Security Checks	11/12/2026	11/12/2026	medium
379821	Amazon Linux 2 : gstreamer1-plugins-bad-free (ALAS-2026-4094)	Nessus	Amazon Linux Local Security Checks	11/12/2026	11/12/2026	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium