Security Advisory 2026-0009 (CVE-2026-3086, ZDI-CAN-28911)
| Summary | Out-of-bounds buffer write in H.266 video parser when parsing Adaptation Parameter Set |
| Date | 2026-02-25 |
| Affected Versions | GStreamer gst-plugins-bad >= 1.25.1, < 1.28.1 |
| IDs | GStreamer-SA-2026-0009 CVE-2026-3086 ZDI-CAN-28911 |
Details
An out of bounds write in the H.266 video bitstream parser when parsing Adaptation Parameter Sets (APS) can cause crashes for certain input files, and could possibly also allow code execution through stack manipulation.
Impact
It is possible for a malicious third party to trigger a buffer overflow that can result in a crash of the application and possibly also allow code execution through stack manipulation.
Solution
The gst-plugins-bad 1.28.1 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.