Every CVE Search/ Get API key

CVE-2026-53701

Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds write in h.266/vvc pps picture partition parser

6.5 MediumFix available

An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser in gst-plugins-bad. In the multi-slice-in-tile processing of gst_h266_parser_parse_picture_partition() (gsth266parser.c), the loop iterates without checking that the slice index stays within bounds, writing past three fixed-size arrays (slice_height_in_ctus, slice_top_left_ctu_x, slice_top_left_ctu_y) in the GstH266PPS structure. While the initial proof-of-concept demonstrated a 4-byte out-of-bounds write, the code permits larger writes across multiple iterations. A crafted H.266/VVC media file can trigger this vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.21%Up 0.2 points since Jun 12, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.5

Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds write in h.266/vvc pps picture partition parser

An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser in gst-plugins-bad. In the multi-slice-in-tile processing of gst_h266_parser_parse_picture_partition() (gsth266parser.c), the loop iterates without checking that the slice index stays within bounds, writing past three fixed-size arrays (slice_height_in_ctus, slice_top_left_ctu_x, slice_top_left_ctu_y) in the GstH266PPS structure. While the initial proof-of-concept demonstrated a 4-byte out-of-bounds write, the code permits larger writes across multiple iterations. A crafted H.266/VVC media file can trigger this vulnerability.

Record
CVE-2026-53701
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-787
Updated
2026-11-05
EUVDEUVD-2026-36294 6.5

An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser in gst-plugins-bad. In the multi-slice-in-tile processing of gst_h266_parser_parse_picture_partition() (gsth266parser.c), the loop iterates without checking that the slice index stays within bounds, writing past three fixed-size arrays (slice_height_in_ctus, slice_top_left_ctu_x, slice_top_left_ctu_y) in the GstH266PPS structure. While the initial proof-of-concept demonstrated a 4-byte out-of-bounds write, the code permits larger writes across multiple iterations. A crafted H.266/VVC media file can trigger this vulnerability.

Record
EUVD-2026-36294
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-05
GitHub AdvisoriesGHSA-2f39-4x7j-f7fp 6.5

An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition...

An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser in gst-plugins-bad. In the multi-slice-in-tile processing of gst_h266_parser_parse_picture_partition() (gsth266parser.c), the loop iterates without checking that the slice index stays within bounds, writing past three fixed-size arrays (slice_height_in_ctus, slice_top_left_ctu_x, slice_top_left_ctu_y) in the GstH266PPS structure. While the initial proof-of-concept demonstrated a 4-byte out-of-bounds write, the code permits larger writes across multiple iterations. A crafted H.266/VVC media file can trigger this vulnerability.

Record
GHSA-2f39-4x7j-f7fp
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-787
Updated
2026-11-02
NVD 6.5

An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser in gst-plugins-bad. In the multi-slice-in-tile processing of gst_h266_parser_parse_picture_partition() (gsth266parser.c), the loop iterates without checking that the slice index stays within bounds, writing past three fixed-size arrays (slice_height_in_ctus, slice_top_left_ctu_x, slice_top_left_ctu_y) in the GstH266PPS structure. While the initial proof-of-concept demonstrated a 4-byte out-of-bounds write, the code permits larger writes across multiple iterations. A crafted H.266/VVC media file can trigger this vulnerability.

Record
CVE-2026-53701
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-787
Updated
2026-11-05
OSVDEBIAN-CVE-2026-53701 6.5

An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser in gst-plugins-bad. In the multi-slice-in-tile processing of gst_h266_parser_parse_picture_partition() (gsth266parser.c), the loop iterates without checking that the slice index stays within bounds, writing past three fixed-size arrays (slice_height_in_ctus, slice_top_left_ctu_x, slice_top_left_ctu_y) in the GstH266PPS structure. While the initial proof-of-concept demonstrated a 4-byte out-of-bounds write, the code permits larger writes across multiple iterations. A crafted H.266/VVC media file can trigger this vulnerability.

Record
DEBIAN-CVE-2026-53701
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-53701 6.5

An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser in gst-plugins-bad. In the multi-slice-in-tile processing of gst_h266_parser_parse_picture_partition() (gsth266parser.c), the loop iterates without checking that the slice index stays within bounds, writing past three fixed-size arrays (slice_height_in_ctus, slice_top_left_ctu_x, slice_top_left_ctu_y) in the GstH266PPS structure. While the initial proof-of-concept demonstrated a 4-byte out-of-bounds write, the code permits larger writes across multiple iterations. A crafted H.266/VVC media file can trigger this vulnerability.

Record
UBUNTU-CVE-2026-53701
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVopenSUSE-SU-2026:21370-1 No score

Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issues

  • CVE-2026-12891: unchecked aspect_ratio_idc value used as an array index in the H.266 parser could cause a global out- of-bounds read (bsc#1268872).
  • CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser (bsc#1268971).
  • CVE-2026-14935: webrtcbin accepts remote SDP without a=fingerprint due to inverted presence check (bsc#1271051).
  • CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write (bsc#1268406).
  • CVE-2026-52721: crafted PCAP records during IPv4 or TCP header parsing could cause an out-of-bounds read (bsc#1268408).
  • CVE-2026-52722: crafted VMnc stream with large cursor dimensions can overflow signed integer (bsc#1268410).
  • CVE-2026-53701: multi-slice-in-tile partitions without slice index bounds checks could trigger an out-of-bounds write (bsc#1268172).
  • CVE-2026-53702: incorrect loop bound during H.265 SEI message parsing could result in a stack buffer overflow (bsc#1268168).
  • CVE-2026-59692: unvalidated peer certificate Subject DN printed during a DTLS handshake could cause a stack buffer overflow (bsc#1271168).
Record
openSUSE-SU-2026:21370-1
Updated
2026-11-02
OSVSUSE-SU-2026:22752-1 No score

Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issues

  • CVE-2026-12891: unchecked aspect_ratio_idc value used as an array index in the H.266 parser could cause a global out- of-bounds read (bsc#1268872).
  • CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser (bsc#1268971).
  • CVE-2026-14935: webrtcbin accepts remote SDP without a=fingerprint due to inverted presence check (bsc#1271051).
  • CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write (bsc#1268406).
  • CVE-2026-52721: crafted PCAP records during IPv4 or TCP header parsing could cause an out-of-bounds read (bsc#1268408).
  • CVE-2026-52722: crafted VMnc stream with large cursor dimensions can overflow signed integer (bsc#1268410).
  • CVE-2026-53701: multi-slice-in-tile partitions without slice index bounds checks could trigger an out-of-bounds write (bsc#1268172).
  • CVE-2026-53702: incorrect loop bound during H.265 SEI message parsing could result in a stack buffer overflow (bsc#1268168).
  • CVE-2026-59692: unvalidated peer certificate Subject DN printed during a DTLS handshake could cause a stack buffer overflow (bsc#1271168).
Record
SUSE-SU-2026:22752-1
Updated
2026-11-02
OSVSUSE-SU-2026:22817-1 No score

Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issues

  • CVE-2026-12891: unchecked aspect_ratio_idc value used as an array index in the H.266 parser could cause a global out- of-bounds read (bsc#1268872).
  • CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser (bsc#1268971).
  • CVE-2026-14935: webrtcbin accepts remote SDP without a=fingerprint due to inverted presence check (bsc#1271051).
  • CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write (bsc#1268406).
  • CVE-2026-52721: crafted PCAP records during IPv4 or TCP header parsing could cause an out-of-bounds read (bsc#1268408).
  • CVE-2026-52722: crafted VMnc stream with large cursor dimensions can overflow signed integer (bsc#1268410).
  • CVE-2026-53701: multi-slice-in-tile partitions without slice index bounds checks could trigger an out-of-bounds write (bsc#1268172).
  • CVE-2026-53702: incorrect loop bound during H.265 SEI message parsing could result in a stack buffer overflow (bsc#1268168).
  • CVE-2026-59692: unvalidated peer certificate Subject DN printed during a DTLS handshake could cause a stack buffer overflow (bsc#1271168).
Record
SUSE-SU-2026:22817-1
Updated
2026-11-02
OSVUSN-8446-1 No score

gst-plugins-bad1.0 vulnerabilities

It was discovered that GStreamer Bad Plugins incorrectly handled parsing H.266/VVC picture partition data. An attacker could use this issue to cause GStreamer Bad Plugins to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-53701)

It was discovered that GStreamer Bad Plugins incorrectly handled parsing H.265 buffering period metadata. An attacker could use this issue to cause GStreamer Bad Plugins to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-53702)

Record
USN-8446-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gst-plugins-bad1.0
Debian:13
 before 1.26.2-3+deb13u2, plus listed versions
1.26.2-31.26.2-3+deb13u1
1.26.2-3+deb13u2
gst-plugins-bad1.0
Debian:14
 before 1.28.3-1, plus listed versions
1.26.10-11.26.10-21.26.2-31.26.3-11.26.4-1
Show 23 moreShow less
1.26.5-11.26.5-21.26.6-11.26.6-21.26.6-31.26.6-41.26.6-51.26.7-11.26.7-21.26.8-11.26.9-11.27.1-11.27.2-11.27.50-11.27.90-11.27.90-21.27.90-31.28.0-11.28.1-11.28.1-21.28.1-31.28.2-11.28.2-2
1.28.3-1
gstreamer-plugins-bad
SUSE:Linux Micro 6.2
From an advisory covering 9 CVEs
 before 1.26.7-160000.3.1
1.26.7-160000.3.1
gstreamer-plugins-bad
SUSE:Linux Enterprise Server 16.0
From an advisory covering 9 CVEs
 before 1.26.7-160000.3.1
1.26.7-160000.3.1
gstreamer-plugins-bad
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 9 CVEs
 before 1.26.7-160000.3.1
1.26.7-160000.3.1
gst-plugins-bad1.0
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.2.0-3ubuntu51.2.1-1ubuntu11.2.1-1ubuntu21.2.2-1ubuntu11.2.2-1ubuntu2
Show 6 moreShow less
1.2.2-1ubuntu41.2.3-1ubuntu11.2.3-1ubuntu21.2.4-1~ubuntu11.2.4-1~ubuntu1.11.2.4-1~ubuntu1.1+esm1
 None known
gst-plugins-bad1.0
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.6.0-1ubuntu11.6.1-1ubuntu11.6.2-1ubuntu11.7.1-1ubuntu11.7.1-1ubuntu3
Show 11 moreShow less
1.7.1-1ubuntu41.7.2-1ubuntu11.7.90-1ubuntu21.7.91-1ubuntu11.8.0-1ubuntu11.8.1-1ubuntu0.11.8.2-1ubuntu0.11.8.2-1ubuntu0.21.8.3-1ubuntu0.21.8.3-1ubuntu0.2+esm11.8.3-1ubuntu0.2+esm2
 None known
gst-plugins-bad1.0
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.12.3-1ubuntu11.12.3-1ubuntu21.12.3-2ubuntu11.12.4-2ubuntu11.12.4-2ubuntu2
Show 8 moreShow less
1.13.1-1ubuntu11.13.91-1ubuntu11.14.0-1ubuntu11.14.1-1ubuntu1~ubuntu18.04.11.14.4-1ubuntu1~ubuntu18.04.11.14.5-0ubuntu1~18.04.11.14.5-0ubuntu1~18.04.1+esm11.14.5-0ubuntu1~18.04.1+esm2
 None known
gst-plugins-bad1.0
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.16.1-1ubuntu11.16.1-1ubuntu31.16.1-1ubuntu41.16.1-1ubuntu51.16.1-1ubuntu6
Show 9 moreShow less
1.16.1-1ubuntu81.16.2-1ubuntu11.16.2-1ubuntu21.16.2-2ubuntu11.16.2-2.1ubuntu11.16.3-0ubuntu11.16.3-0ubuntu1.11.16.3-0ubuntu1.1+esm11.16.3-0ubuntu1.1+esm2
 None known
gst-plugins-bad1.0
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.18.5-1ubuntu11.18.5-1ubuntu31.20.0-2ubuntu21.20.1-1ubuntu21.20.3-0ubuntu11.20.3-0ubuntu1.11.20.3-0ubuntu1.1+esm21.20.3-0ubuntu1.1+esm3
 None known
Show 5 moreShow less
Affected packages
PackageAffectedFixed
gst-plugins-bad1.0
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.22.4-1ubuntu11.22.4-1ubuntu21.22.4-1ubuntu41.22.9-2ubuntu11.24.0-1ubuntu3
Show 4 moreShow less
1.24.0-1ubuntu41.24.2-1ubuntu41.24.2-1ubuntu4+esm11.24.2-1ubuntu4+esm2
 None known
gst-plugins-bad1.0
Ubuntu:25.10
 All versions, plus listed versions
1.26.0-1ubuntu21.26.2-1ubuntu11.26.3-1ubuntu11.26.4-1ubuntu11.26.5-1ubuntu2
 None known
gst-plugins-bad1.0
Ubuntu:26.04:LTS
 before 1.28.2-1ubuntu1.1, plus listed versions
1.26.5-1ubuntu21.27.2-1ubuntu11.27.90-1ubuntu21.28.0-1ubuntu21.28.1-2ubuntu21.28.1-2ubuntu31.28.2-1ubuntu1
1.28.2-1ubuntu1.1
gst-plugins-bad1.0
Ubuntu:26.04:LTS
From an advisory covering 2 CVEs
 before 1.28.2-1ubuntu1.1, plus listed versions
1.26.5-1ubuntu21.27.2-1ubuntu11.27.90-1ubuntu21.28.0-1ubuntu21.28.1-2ubuntu21.28.1-2ubuntu31.28.2-1ubuntu1
1.28.2-1ubuntu1.1
gstreamer-plugins-bad
openSUSE:Leap 16.0
From an advisory covering 9 CVEs
 before 1.26.7-160000.3.1
1.26.7-160000.3.1

History

History
RecordedChangedSources
affectedEUVD, NVD
factsCVE List
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-53701 is a medium vulnerability (CVSS 6.5) in Red Hat Enterprise Linux 10, published June 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 10th percentile. Fixed in gst-plugins-bad1.0 1.26.2-3+deb13u2.

References

Show 25 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open