Executive brief
A vulnerability exists in GStreamer, a widely used multimedia framework for processing video and audio. By tricking a user into opening a specially crafted H.266/VVC video file, an attacker can cause the application to crash or behave unexpectedly. This could lead to a denial of service, impacting the reliability of media players or video processing services.
Technical details
An out-of-bounds write vulnerability (CWE-787) exists in the gst_h266_parser_parse_picture_partition() function within gsth266parser.c. The root cause is a lack of bounds checking on the slice index during multi-slice-in-tile processing, allowing the loop to write past three fixed-size arrays (slice_height_in_ctus, slice_top_left_ctu_x, and slice_top_left_ctu_y) in the GstH266PPS structure. An attacker can exploit this by providing a maliciously crafted H.266/VVC media file. Successful exploitation requires a user to open the file (UI:R) and can result in a denial of service. The issue is fixed in GStreamer version 1.28.3.
Affected products
- GStreamer gst-plugins-bad-free versions before 1.28.3
Timeline
- 2026-06-10: disclosed: Reported via PSIRTSUPT-7239 by Tianshuo Han
- 2026-06-11: advisory: NVD and Red Hat published advisory details
- 2026-06-11: patched: Fixed in GStreamer 1.28.3 via commit f66e8292ed