ZeroDay Findings
Sign inSign up

Findings

CVE-2026-53701

An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser in gst-plugins-bad.

Published Jun 11, 2026 · updated Oct 15, 2026

An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser in gst-plugins-bad. In the multi-slice-in-tile processing of gst_h266_parser_parse_picture_partition() (gsth266parser.c), the loop iterates without checking that the slice index stays within bounds, writing past three fixed-size arrays (slice_height_in_ctus, slice_top_left_ctu_x, slice_top_left_ctu_y) in the GstH266PPS structure. While the initial proof-of-concept demonstrated a 4-byte out-of-bounds write, the code permits larger writes across multiple iterations. A crafted H.266/VVC media file can trigger this vulnerability.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Jun 11, 2026 · OSV.dev

    Detected

    An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser in gst-plugins-bad. In the multi-slice-in-tile processing of gst_h266_parser_parse_picture_partition() (gsth266parser.c), the loop iterates without checking that the slice index stays within bounds, writing past three fixed-size arrays (slice_height_in_ctus, slice_top_left_ctu_x, slice_top_left_ctu

  2. Oct 15, 2026 · OSV.dev

    Fix available

    gst-plugins-bad1.0 fixed in 1.26.2-3+deb13u2; gst-plugins-bad1.0 fixed in 1.28.3-1

  3. Oct 15, 2026 · OSV.dev

    Fix available

    gst-plugins-bad1.0 fixed in 1.26.2-3+deb13u2

  4. Oct 15, 2026 · OSV.dev

    Fix available

    gst-plugins-bad1.0 fixed in 1.28.3-1

  5. Oct 15, 2026 · OSV.dev

    Updated

    An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser in gst-plugins-bad. In the multi-slice-in-tile processing of gst_h266_parser_parse_picture_partition() (gsth266parser.c), the loop iterates without checking that the slice index stays within bounds, writing past three fixed-size arrays (slice_height_in_ctus, slice_top_left_ctu_x, slice_top_left_ctu

Affected

  • Debian:13 gst-plugins-bad1.00 → 1.26.2-3+deb13u2
  • Debian:14 gst-plugins-bad1.00 → 1.28.3-1

Sources

References