Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-10T00:00:00 gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds write in H.266/VVC PPS picture partition parser 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CWE-787

An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser in gst-plugins-bad. In the multi-slice-in-tile processing of gst_h266_parser_parse_picture_partition() (gsth266parser.c), the loop iterates without checking that the slice index stays within bounds, writing past three fixed-size arrays (slice_height_in_ctus, slice_top_left_ctu_x, slice_top_left_ctu_y) in the GstH266PPS structure. While the initial proof-of-concept demonstrated a 4-byte out-of-bounds write, the code permits larger writes across multiple iterations. A crafted H.266/VVC media file can trigger this vulnerability.

An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser in gst-plugins-bad. In the multi-slice-in-tile processing of gst_h266_parser_parse_picture_partition() (gsth266parser.c), the loop iterates without checking that the slice index stays within bounds, writing past three fixed-size arrays (slice_height_in_ctus, slice_top_left_ctu_x, slice_top_left_ctu_y) in the GstH266PPS structure. While the initial proof-of-concept demonstrated a 4-byte out-of-bounds write, the code permits larger writes across multiple iterations. A crafted H.266/VVC media file can trigger this vulnerability.

The H.266/VVC codec parser is part of gst-plugins-bad and is available in GStreamer 1.26 and later. Older versions of GStreamer shipped in Red Hat Enterprise Linux do not include H.266 support and are not affected. The upstream maintainer confirmed the out-of-bounds write is bounded within preallocated structure arrays and did not cause crashes in testing. Practical exploitation for code execution is considered unlikely with modern hardening such as ASLR and stack protectors. Red Hat would like to thank Tianshuo Han for reporting this issue. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat Enterprise Linux 10 Fix deferred gstreamer1-plugins-bad-free Red Hat Enterprise Linux 7 Fix deferred gstreamer1-plugins-bad-free Red Hat Enterprise Linux 8 Fix deferred gstreamer1-plugins-bad-free Red Hat Enterprise Linux 9 Fix deferred gstreamer1-plugins-bad-free https://www.cve.org/CVERecord?id=CVE-2026-53701 https://nvd.nist.gov/vuln/detail/CVE-2026-53701