REDHAT-BUG-2564164: Buffer Overflow
GStreamer Security Advisory GStreamer-SA-2026-0017 reports an integer overflow in the gst-plugins-bad H.266/VVC parser while parsing profile, tier, and level fields from malformed H.266 streams. The resulting stack-based buffer overflow may crash an application processing malicious media and could possibly allow code execution. Upstream lists gst-plugins-bad versions 1.25.1 through versions before 1.28.2 as affected; version 1.28.2 contains the fix. The local verification report confirmed the code pattern by static analysis but did not confirm the exact exploit path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gst-plugins-badto a version that resolves this vulnerability.Fixed in 1.28.2
Event History
Frequently Asked Questions
Which upstream gst-plugins-bad versions require remediation?
Upstream identifies versions 1.25.1 through versions before 1.28.2 as affected. Version 1.28.2 contains the fix.
What must an attacker provide to trigger the issue?
An application must process a malformed H.266/VVC media stream containing crafted profile, tier, or level fields. The reported outcome is a stack-based buffer overflow that may crash the application and could possibly permit code execution.
How certain is exploitation in the affected code path?
Local static analysis confirmed the vulnerable code pattern, but did not confirm the exact exploit path. The advisory therefore supports treating affected versions as vulnerable while recognizing that exploitability was not locally demonstrated.