EUVD-2026-36294
GHSA-2f39-4x7j-f7fp
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
OOB write corrupts adjacent heap memory (I:L) and crashes the process (A:H); network delivery requires user file-open interaction only.
Primary rating from Vendor (redhat).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionNVD
An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser in gst-plugins-bad. In the multi-slice-in-tile processing of gst_h266_parser_parse_picture_partition() (gsth266parser.c), the loop iterates without checking that the slice index stays within bounds, writing past three fixed-size arrays (slice_height_in_ctus, slice_top_left_ctu_x, slice_top_left_ctu_y) in the GstH266PPS structure. While the initial proof-of-concept demonstrated a 4-byte out-of-bounds write, the code permits larger writes across multiple iterations. A crafted H.266/VVC media file can trigger this vulnerability.
AnalysisAI
Out-of-bounds write in GStreamer's H.266/VVC PPS picture partition parser (gst-plugins-bad) allows an attacker to crash media-processing applications - and potentially achieve code execution - by delivering a crafted H.266/VVC media file. The flaw in gst_h266_parser_parse_picture_partition() (gsth266parser.c) permits unbounded slice index increments across three fixed-size arrays in GstH266PPS during multi-slice-in-tile processing. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerability triggers during parsing of an H.266/VVC media file that contains a Picture Parameter Set (PPS) with multi-slice-in-tile data encoding more slices than the fixed-size arrays in `GstH266PPS` can accommodate - this malformed condition must be crafted intentionally. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 score of 6.5 Medium (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) reflects a network-reachable, zero-privilege attack path gated only by user interaction - a user must open or stream the crafted H.266/VVC file. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts an H.266/VVC video file with a malformed PPS encoding an abnormally large slice count in multi-slice-in-tile mode, then delivers it via email attachment, a web page embedding video, or a media-sharing link. When a user on an affected RHEL system opens the file with a GStreamer-backed media player, `gst_h266_parser_parse_picture_partition()` iterates past the bounds of the three fixed-size arrays in `GstH266PPS`, overwriting adjacent heap memory. … |
| Remediation | No vendor-released patch version was identified in the available intelligence at time of analysis; the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-53701 and Red Hat Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2487611 should be monitored for errata. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Remote denial of service in 389 Directory Server (Red Hat Directory Server 11/12/13 and Red Hat Enterprise Linux 6 throu
Out-of-bounds heap write in QEMU's virtio-blk device allows a high-privileged guest to crash the host QEMU process. The
Denial-of-service in Red Hat's 389 Directory Server allows a highly privileged network attacker to crash the LDAP servic
Out-of-bounds read in 389 Directory Server's LDIF parser exposes limited heap memory to a highly privileged local attack
Denial of service in Red Hat 389 Directory Server's Content Synchronization persistent search plugin enables authenticat
Share
External POC / Exploit Code
Leaving vuln.today