A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed into a fixed-size 2048-byte stack buffer without bounds checking. A remote unauthenticated attacker can send a certificate with an oversized Subject DN that exceeds the buffer, causing a stack buffer overflow and process crash, resulting in denial of service.

An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser reads a segment length value from the bitstream without validating it against available data. A remote attacker could trick a user into opening a specially crafted JPEG file, causing downstream parsing to read beyond the provided input buffer, leading to a crash or potential information disclosure.

A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values into a buffer allocated for 16-bit pixels. This type mismatch causes an out-of-bounds heap write that can lead to denial of service (process crash) and potential memory corruption.

GStreamer VA JPEG decoder out-of-bounds read vulnerability. In gstjpegparser.c (gst-plugins-bad), the gstjpegparse() function reads a segment length from the bitstream without validating it against available data. The VA JPEG decoder path trusts this untrusted seg->size value and constructs a byte reader over an inflated range, reading past the buffer. The code's own comment explicitly acknowledges this: "a valid segment may be returned with a length that exceeds the available data." Upstream confirmed by maintainer Sebastian Dröge (2026-06-02), who noted it is "actually a bug in the VA JPEG decoder in gst-plugins-bad" and "an OOB read that could lead to a crash or possibly information disclosure." Fix planned for GStreamer 1.28.4 or 1.28.5. Upstream issue: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/workitems/5104 (confidential). Reported via PSIRTSUPT-17026 by JUNYI LIU / Moss 1.

A stack buffer overflow was found in GStreamer's DTLS plugin (gst-plugins-bad). In opensslverifycallback(), the peer certificate Subject DN is printed using X509NAMEprintex() into a memory BIO, then read via BIOread() into a fixed gchar buf[2048] on the stack. The number of bytes read comes directly from the X509NAMEprintex() return value without bounds checking against the buffer size.

A remote DTLS peer can send a certificate with an oversized Subject DN (many long OU fields) so that the formatted output exceeds 2048 bytes, causing a stack buffer overflow during the DTLS handshake.

File: subprojects/gst-plugins-bad/ext/dtls/gstdtlsconnection.c Function: opensslverifycallback() (lines 1136-1144)

Exploitability analysis: - The overflow content is TEXT ONLY (X509NAMEprintex with XNFLAGMULTILINE escapes all binary/control characters to printable ASCII sequences like \XX) - Stack canary (-fstack-protector-strong) terminates the process before return address corruption is exploitable - Arbitrary byte injection is impossible: null bytes become \00 (3 printable chars), high-bit bytes become \XX - RCE is NOT achievable. Maximum impact is denial of service (crash)

Attack vector: Unauthenticated remote DTLS-SRTP/WebRTC peer triggers this during handshake by presenting a crafted certificate. No user interaction required.

Affected: GStreamer gst-plugins-bad (reproduced on 1.28.3) Fixed: Planned for GStreamer 1.28.5 Fix MR: https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/mergerequests/99 Upstream issue: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/workitems/5172 (confidential) Advisory: GST-SA-2026-0062

Reporter: Clouditera Security; Z.ai Security; NSFOCUS PSIRT Ticket: PSIRTSUPT-19090

A heap buffer overflow was found in GStreamer's rfbsrc plugin (gst-plugins-bad, librfb component). In rfbdecoderfillrectangle(), when a malicious RFB/VNC server advertises a 16bpp RGB565 framebuffer and sends a Hextile-encoded update, the background fill path computes the destination offset using decoder->bytespp (2 bytes) but casts the destination to guint32 and writes one 32-bit value per pixel. For bytespp == 2, the framebuffer is allocated as 2 bytes per pixel, but the fill loop writes and advances by 4 bytes per pixel, causing a heap out-of-bounds write.

File: subprojects/gst-plugins-bad/gst/librfb/rfbdecoder.c Function: rfbdecoderfillrectangle()

A remote attacker controlling an RFB/VNC server can trigger this by having a client connect using rfbsrc. The demonstrated impact is heap-buffer-overflow and process abort. Since this is a heap out-of-bounds write on remote input, integrity impact is possible though code execution has not been demonstrated.

Affected: GStreamer gst-plugins-bad (reproduced on 1.28.3) Fixed: Planned for GStreamer 1.28.5 Fix MR: https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/mergerequests/100 Upstream issue: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/workitems/5173 (confidential) Advisory: GST-SA-2026-0063

Reporter: Clouditera Security; Z.ai Security; NSFOCUS PSIRT Ticket: PSIRTSUPT-19089

An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser in gst-plugins-bad. In the multi-slice-in-tile processing of gsth266parserparsepicturepartition() (gsth266parser.c), the loop iterates without checking that the slice index stays within bounds, writing past three fixed-size arrays (sliceheightinctus, slicetopleftctux, slicetopleftctuy) in the GstH266PPS structure. While the initial proof-of-concept demonstrated a 4-byte out-of-bounds write, the code permits larger writes across multiple iterations. A crafted H.266/VVC media file can trigger this vulnerability.

A stack buffer overflow flaw was found in the GStreamer H.265 codec parser library (gst-plugins-bad). When parsing a buffering period SEI message, the parser uses an incorrect loop bound derived from cpbcntminus1[i] (the loop index) instead of the sub-layer 0 CPB count cpbcntminus1[0] from the referenced Sequence Parameter Set. A crafted H.265 video file or stream can cause the parser to write beyond the bounds of stack-allocated CPB delay arrays, resulting in a crash or potential stack memory corruption.

A denial of service vulnerability was found in GStreamer's AV1 codec parser in gst-plugins-bad. The gstav1parserparsetilelistobu() function passes a byte count to a bit-reader API that expects a bit count, causing parser desynchronization. A remote attacker could trick a user into opening a specially crafted AV1 media file, triggering an assertion abort and causing the application to crash.

A 1-byte heap out-of-bounds read vulnerability exists in the gsth264parseprocessnal() function in subprojects/gst-plugins-bad/gst/videoparsers/gsth264parse.c. The function processes H.264 NAL units including GSTH264NALSLICEEXT (NAL type 20) for MVC/SVC extension slices. At line 1132, the code dereferences (nalu->data + nalu->offset + nalu->headerbytes) to check the firstmbinslice flag without first verifying that nalu->size > nalu->headerbytes. For extension slice types, headerbytes is set to 4 (1 byte base + 3 bytes extension header per gsth264parser.c:243). A malformed NAL unit with exactly size==4 passes the minimum size check (size >= 2 at line 999) but triggers a 1-byte read at offset 4, which is beyond the allocated buffer. The same bounds check pattern is correctly implemented in gsth264parsecollectnal() at line 1259 with if (nalu->size > nalu->headerbytes). The vulnerability affects GStreamer 1.x versions (tested against git version 1.29.1.1). Upstream maintainer Sebastian Droege confirmed the vulnerability via GitLab work item 5108. Reported by Dr. Faruk Kazi, Ramesh Adhikari, and Ariba Afroz from CoE-CNDS Lab, VJTI, Mumbai, India. PSIRT Ticket: PSIRTSUPT-17585.

A flaw was found in the GStreamer gst-plugins-bad package. When processing a malformed H.266/VVC video stream with a crafted aspect ratio indicator value, the H.266 parser performs an out-of-bounds read of up to 8 bytes from adjacent memory. This flaw allows an attacker to craft a malicious H.266 video file or stream that, when processed by a GStreamer-based application, could leak limited memory contents through video metadata, potentially exposing sensitive information from the application's address space.

GStreamer AV1 tilelistobu parser abort vulnerability. The gstav1parserparsetilelistobu() function in gstav1parser.c (gst-plugins-bad) passes a byte count to gstbitreaderskip(), which expects a bit count. This causes parser desynchronization and a deterministic gassert abort when processing a specially crafted AV1 media file. A 21-byte test case is sufficient to trigger the crash. Upstream confirmed by maintainer Sebastian Dröge (2026-06-02). Fix planned for GStreamer 1.28.4 or 1.28.5. Upstream issue: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/workitems/5103 (confidential). Reported via PSIRTSUPT-17026 by JUNYI LIU / Moss 1.

A 1-byte heap out-of-bounds read vulnerability exists in the gsth264parseprocessnal() function in subprojects/gst-plugins-bad/gst/videoparsers/gsth264parse.c. The function processes H.264 NAL units including GSTH264NALSLICEEXT (NAL type 20) for MVC/SVC extension slices. At line 1132, the code dereferences (nalu->data + nalu->offset + nalu->headerbytes) to check the firstmbinslice flag without first verifying that nalu->size > nalu->headerbytes. For extension slice types, headerbytes is set to 4 (1 byte base + 3 bytes extension header per gsth264parser.c:243). A malformed NAL unit with exactly size==4 passes the minimum size check (size >= 2 at line 999) but triggers a 1-byte read at offset 4, which is beyond the allocated buffer. The same bounds check pattern is correctly implemented in gsth264parsecollectnal() at line 1259 with if (nalu->size > nalu->headerbytes). The vulnerability affects GStreamer 1.x versions (tested against git version 1.29.1.1). Upstream maintainer Sebastian Droege confirmed the vulnerability via GitLab work item 5108. Reported by Dr. Faruk Kazi, Ramesh Adhikari, and Ariba Afroz from CoE-CNDS Lab, VJTI, Mumbai, India. PSIRT Ticket: PSIRTSUPT-17585.