Security Advisory 2026-0056

Details

A heap-based buffer overflow in the H.266 (VVC) video bitstream parser in gst-plugins-bad when parsing slice headers. The vulnerability occurs in the code that tracks CTU entry points during slice header parsing. A bounds check on the fixed-size entry point array was performed after the loop that populates it, rather than before each write, allowing a crafted H.266 stream with many tile or entropy-coding sync boundaries to write past the end of the heap- allocated array.

Impact

It is possible for a malicious third party to trigger a heap buffer overflow that can result in a crash of the application or possibly also allow code execution through heap manipulation when processing a crafted H.266 video stream.

Solution

The gst-plugins-bad 1.28.5 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.5 release

• Release Notes
• GStreamer Plugins Bad 1.28.5

Patches

• Patch