REDHAT-BUG-2541471: Low severity GStreamer libgstcodecparsers vulnerability

Published Sep 25, 2026

Updated

GStreamer's H.266 (VVC) codec parser library (libgstcodecparsers) contains an out-of-bounds write vulnerability in gsth266parserparsedci() in gsth266parser.c (line 4812). CHECKALLOWEDMAX(dci->numptlsminus1, 15) allows value 15, but GstH266DCI.profiletierlevel[] has only 15 elements (indices 0..14). When dcinumptlsminus1 is 15, the loop writes past the structure via gsth266parseprofiletierlevel(). H.266 spec defines valid range 0..14; 15 is reserved. Fix: change bound to 14. Introduced in GStreamer 1.26. No in-tree element calls this API. Upstream report awaiting triage, no public patch. Reporter: Bruno Fournier. Tested on 1.29.2 (4cb910d) with ASan. PSIRT: PSIRTSUPT-24646.

Affected Software

1 affected component

GStreamer libgstcodecparsers>=1.26

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Change the CHECK_ALLOWED_MAX bound for dci->num_ptls_minus1 from 15 to 14.
GStreamer's libgstcodecparsers H.266 parser CHECK_ALLOWED_MAX(dci->num_ptls_minus1, ...) bound in gst_h266_parser_parse_dci() = 14

Event History

Sep 25, 2026

Data Sourced

via Red Hat·03:28 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is realistically exposed to this issue?

No in-tree GStreamer element calls the affected API. Exposure is therefore limited to applications or external components that invoke gst_h266_parser_parse_dci(), particularly when they parse attacker-controlled H.266 bitstreams.

What input is required to trigger the out-of-bounds write?

An H.266 DCI structure must contain dci_num_ptls_minus1 set to 15. This value is reserved by the H.266 specification; valid values are 0 through 14.

What can be done before a patch is available?

Reject DCI inputs whose dci_num_ptls_minus1 value is 15 before they reach the parser, or avoid processing untrusted H.266 DCI data through this API. The stated code correction is to enforce a maximum value of 14; no public patch is available.

Which versions are known to contain the issue?

The issue was introduced in GStreamer 1.26. It was tested on version 1.29.2 (commit 4cb910d) using ASan.

REDHAT-BUG-2541471: Low severity GStreamer libgstcodecparsers vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What input is required to trigger the out-of-bounds write?

What can be done before a patch is available?

Which versions are known to contain the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What input is required to trigger the out-of-bounds write?

What can be done before a patch is available?

Which versions are known to contain the issue?