Security Advisory 2026-0010 (CVE-2026-3081, ZDI-CAN-28839)
| Summary | Stack buffer overflow in H.266 video parser when parsing pic_timing SEIs |
| Date | 2026-02-25 |
| Affected Versions | GStreamer gst-plugins-bad >= 1.25.1, < 1.28.1 |
| IDs | GStreamer-SA-2026-0010 CVE-2026-3081 ZDI-CAN-28839 |
Details
A stack overflow in the H.266 video bitstream parser when parsing pic_timing SEIs can cause crashes for certain input files, and could possibly also allow code execution through stack manipulation.
Impact
It is possible for a malicious third party to trigger a buffer overflow that can result in a crash of the application and possibly also allow code execution through stack manipulation.
Solution
The gst-plugins-bad 1.28.1 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.