Security Advisory 2026-0055

Details

An out-of-bounds read vulnerability in the H.266/VVC codec parser (gsth266parser) in gst-plugins-bad when parsing Picture Parameter Set (PPS) tile slices. The parser iterates over explicitly signalled slice heights using a count that is constrained only by the tile row height in coding tree units. For large pictures this count can exceed the fixed array dimension of 440, allowing reads beyond the second dimension of the slice height storage array. A previous fix for CVE-2026-53701 added bounds validation for the first dimension of the array but did not address the second dimension.

Impact

A malicious third party could trigger an out-of-bounds read by providing a crafted H.266/VVC video stream with a large picture dimension and an excessive number of explicitly signalled slices per tile, potentially resulting in a crash, denial of service, or information disclosure.

Solution

The gst-plugins-bad 1.28.5 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.5 release

• Release Notes
• GStreamer Plugins Bad 1.28.5

Patches

• Patch