Security Advisory 2026-0070
|
|
| Summary |
Out-of bounds write in H.265/HEVC parser short-term RPS parsing |
| Date |
2026-08-05 |
| Affected Versions |
GStreamer gst-plugins-bad < 1.28.6 |
| IDs |
GStreamer-SA-2026-0070 |
Details
An out-of-bounds write vulnerability in the H.265/HEVC codec parser (gsth265parser) in gst-plugins-bad when parsing short-term reference picture set.
The parser failed to enforce the defined limit on the number of
derived reference picture entries when inter_ref_pic_set_prediction_flag was set.
A specially crafted sequence parameter set could cause the parser to derive more reference
picture entries than allowed, resulting in writes beyond the intended bounds
of the internal RPS arrays during SPS parsing.
Impact
A malicious third party could trigger an out-of-bounds write by providing a crafted H.265/HEVC
video stream containing malformed sequence parameter set, potentially resulting in a crash, denial of service, or information disclosure.
Solution
The gst-plugins-bad 1.28.6 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.
References
The GStreamer project
CVE Database Entries
- No CVE number assigned or pending
GStreamer 1.28.6 release
Patches
