Executive brief
A security vulnerability exists in a widely used multimedia framework component responsible for processing H.265 video files. By tricking a user into opening a specially crafted video file or stream, an attacker can cause the application to crash or potentially corrupt its memory. This could lead to service disruptions or allow for further unauthorized actions on the affected system.
Technical details
A stack-based buffer overflow exists in the gst_h265_parser_parse_buffering_period() function within GStreamer's gst-plugins-bad. The vulnerability is caused by an incorrect loop bound when parsing buffering period Supplemental Enhancement Information (SEI) messages; the parser uses cpb_cnt_minus1[i] instead of the sub-layer 0 count cpb_cnt_minus1[0] from the Sequence Parameter Set. This allows an attacker to write beyond the bounds of 32-element stack-allocated CPB delay arrays. Exploitation requires a user to process a malicious H.265 video file or stream, potentially resulting in a denial of service or arbitrary code execution. The issue is fixed in GStreamer version 1.28.3.
Affected products
- GStreamer GStreamer H.265 codec parser library (gst-plugins-bad) versions prior to 1.28.3
Timeline
- 2026-06-10: disclosed: Initial report via PSIRTSUPT-7239
- 2026-06-11: advisory: NVD and Red Hat published advisory details
- 2026-06-11: patched: Fixed in GStreamer 1.28.3 via commit 48c11b7b01