Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-10T00:00:00 gstreamer1-plugins-bad-free: GStreamer: Stack buffer overflow in H.265 buffering period SEI parser 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CWE-787

A stack buffer overflow flaw was found in the GStreamer H.265 codec parser library (gst-plugins-bad). When parsing a buffering period SEI message, the parser uses an incorrect loop bound derived from cpb_cnt_minus1[i] (the loop index) instead of the sub-layer 0 CPB count cpb_cnt_minus1[0] from the referenced Sequence Parameter Set. A crafted H.265 video file or stream can cause the parser to write beyond the bounds of stack-allocated CPB delay arrays, resulting in a crash or potential stack memory corruption.

A stack buffer overflow flaw was found in the GStreamer H.265 codec parser library (gst-plugins-bad). When parsing a buffering period SEI message, the parser uses an incorrect loop bound derived from cpb_cnt_minus1[i] (the loop index) instead of the sub-layer 0 CPB count cpb_cnt_minus1[0] from the referenced Sequence Parameter Set. A crafted H.265 video file or stream can cause the parser to write beyond the bounds of stack-allocated CPB delay arrays, resulting in a crash or potential stack memory corruption.

The upstream maintainer confirmed this flaw causes crashes from crafted H.265 files or streams. Code execution is considered unlikely on Red Hat Enterprise Linux due to standard hardening measures including ASLR and stack protectors. The fix is public in GStreamer 1.28.3 (MR !11334, commit 48c11b7b01). Red Hat would like to thank Tianshuo Han for reporting this issue. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat Enterprise Linux 10 Fix deferred gstreamer1-plugins-bad-free Red Hat Enterprise Linux 7 Fix deferred gstreamer1-plugins-bad-free Red Hat Enterprise Linux 8 Fix deferred gstreamer1-plugins-bad-free Red Hat Enterprise Linux 9 Fix deferred gstreamer1-plugins-bad-free https://www.cve.org/CVERecord?id=CVE-2026-53702 https://nvd.nist.gov/vuln/detail/CVE-2026-53702