GStreamer libgstcodecparsers CVE-2026-100229

Exploitation requires a third-party application that directly invokes the vulnerable DCI parsing function in GStreamer's libgstcodecparsers (H.266/VVC) library; the description explicitly states no standard GStreamer pipeline element reaches this code path, so default GStreamer installations and typical playback pipelines are NOT exploitable. The attacker must deliver a specially crafted H.266 bitstream whose DCI reserved field carries an illegal value that the parser incorrectly accepts. Limiting factors: dependence on a non-standard API consumer sharply narrows the attack surface, and impact is bounded to memory corruption/crash (I:L/A:L) with no confidentiality loss and no demonstrated code-execution path in the provided data.

Red Hat rates this CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - network-reachable, no privileges, no user interaction, but only Low integrity and Low availability impact and no confidentiality impact, consistent with a bounded out-of-bounds write (CWE-787) that most realistically yields a crash. The single most important mitigating signal is in the description itself and directly tempers the network-vector optics: 'No standard GStreamer pipeline element currently invokes the affected code path,' meaning a default GStreamer install is not exploitable and an attacker needs a third-party application that explicitly calls the vulnerable DCI parsing API in libgstcodecparsers. No EPSS probability, CISA KEV listing, or public exploit was provided in the input, so exploitation status is: no public exploit identified at time of analysis. Net: this is a real but modest-priority memory-safety bug - patch it in normal cycles, but the CVSS network vector overstates practical exposure because the vulnerable code path is not reachable through standard pipelines; treat AV:N as 'reachable only via custom API consumers,' not 'remotely exploitable out of the box.' Verify affected GStreamer versions and fix with the Red Hat advisory, as no fixed version is present in the supplied data.

An attacker crafts a malicious H.266/VVC bitstream containing a manipulated DCI reserved field and submits it to a third-party media application that directly invokes libgstcodecparsers' DCI parsing function (not a standard GStreamer pipeline). The parser accepts the illegal reserved value and writes past the bounds of an internal structure, corrupting memory or crashing the process. No public exploit code is identified in the provided data, and exploitation is constrained to applications that reach this specific API.