REDHAT-BUG-2565937: Medium severity GStreamer gst-plugins-bad vulnerability
gst-plugins-bad (GstCodecparsers library) contains a use-of-uninitialized-variable (CWE-457) in gsth265parsevps() in gst-libs/gst/codecparsers/gsth265parser.c. When a VPS NAL unit declares more than one HRD parameter set (vpsnumhrdparameters >= 2), the workaround loop at lines 2152-2165 processes each extra set (i >= 1) into a local GstH265HRDParams hrdparams variable declared at line 2155 that is never zero-initialized before being passed to gsth265parsehrdparameters(). That function sets only three fields to defaults and leaves all other fields as stack garbage, which steers further parsing (including gsth265parsesublayerhrdparameters() at line 439). Bug introduced in upstream GStreamer 1.16.0 (commit 52f2054386). Fix targeted for upstream 1.28.9 (not yet merged as of 2026-10-30; private gstreamer-security MR !132). GStreamer security advisory SA-2026-0094. PSIRT support ticket PSIRTSUPT-29600. Reporter: Sebastian Dröge, Centricular Ltd.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gst-plugins-bad (GstCodecparsers library)to a version that resolves this vulnerability.Fixed in 1.28.9
Event History
Frequently Asked Questions
What input is needed to trigger the vulnerable parsing path?
An attacker-controlled H.265 VPS NAL unit must declare two or more HRD parameter sets, meaning vps_num_hrd_parameters is at least 2. The issue occurs while processing the additional HRD parameter sets after the first one.
Which upstream versions may require review?
The bug was introduced upstream in GStreamer 1.16.0. An upstream fix was targeted for 1.28.9 but had not been merged as of 2026-10-30.
How can I determine whether my workload is exposed?
Identify whether your deployment uses gst-plugins-bad's GstCodecparsers library to parse H.265 bitstreams. Then determine whether it processes VPS NAL units that declare multiple HRD parameter sets, as that is the affected parser path.