REDHAT-BUG-2487612: Buffer Overflow
Published Jun 10, 2026
·Updated
GStreamer H.265 buffering period SEI parser stack buffer overflow. In gsth265parserparsebufferingperiod(), the CPB loop bound used cpbcntminus1[i] instead of cpbcntminus1[0], causing writes past the 32-element CPB arrays on the stack. Fixed in GStreamer 1.28.3 (MR !11334, commit 48c11b7b01). Reported via PSIRTSUPT-7239 by Tianshuo Han.
Affected Software
1 affected component
GStreamer GStreamer<1.28.3
Event History
Jun 10, 2026
Data Sourced
via Red Hat·04:13 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of REDHAT-BUG-2487612?
The severity of REDHAT-BUG-2487612 is medium, rated at 4.
2
How do I fix REDHAT-BUG-2487612?
You can fix REDHAT-BUG-2487612 by upgrading to GStreamer version 1.28.3 or later.
3
What type of vulnerability is REDHAT-BUG-2487612?
REDHAT-BUG-2487612 is classified as a buffer overflow vulnerability.
4
What is the risk associated with REDHAT-BUG-2487612?
The risk associated with REDHAT-BUG-2487612 is rated at 19, indicating a significant potential impact.
5
In which function does REDHAT-BUG-2487612 occur?
REDHAT-BUG-2487612 occurs in the gst_h265_parser_parse_buffering_period() function.