GStreamer's H.266 (VVC) codec parser library (libgstcodecparsers) contains an out-of-bounds write vulnerability in gsth266parserparsedci() in gsth266parser.c (line 4812). CHECKALLOWEDMAX(dci->numptlsminus1, 15) allows value 15, but GstH266DCI.profiletierlevel[] has only 15 elements (indices 0..14). When dcinumptlsminus1 is 15, the loop writes past the structure via gsth266parseprofiletierlevel(). H.266 spec defines valid range 0..14; 15 is reserved. Fix: change bound to 14. Introduced in GStreamer 1.26. No in-tree element calls this API. Upstream report awaiting triage, no public patch. Reporter: Bruno Fournier. Tested on 1.29.2 (4cb910d) with ASan. PSIRT: PSIRTSUPT-24646.