gst-plugins-bad CVE-2026-53702

Exploitation requires that the target system has gst-plugins-bad installed with H.265/HEVC parsing enabled, and that a user actively opens or streams a crafted H.265 video file from an attacker-controlled source (UI:R). The vulnerable code path is triggered specifically by a buffering period SEI message within the H.265 stream containing cpb_cnt_minus1 values that cause the parser's loop to exceed the stack array bounds - this SEI type must be present in the crafted content. No authentication is required of the attacker (PR:N per CVSS), but the victim's user interaction is mandatory. Limiting factors: user must open the malicious content (no drive-by or fully automated path), H.265 codec support via gst-plugins-bad must be present, and the host must run an affected RHEL version. Headless servers, container workloads, and RHEL systems without desktop multimedia applications installed have no meaningful exposure. Modern Linux stack protections (stack canaries, ASLR, NX/DEP) may further limit exploitation beyond denial-of-service.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) accurately characterizes this as a medium-severity availability impact with no confidentiality or integrity consequences confirmed. The network attack vector with no privilege requirement means any reachable user parsing H.265 content is a viable target, but the mandatory user interaction (UI:R) - opening a crafted file or stream - prevents fully automated, wormable exploitation and lowers practical mass-exploitation risk. EPSS data is absent from the provided intelligence, so quantitative exploitation probability cannot be stated. The vulnerability is not listed in CISA KEV, and no POC code was identified; these are the strongest signals that exploitation is not currently widespread. Despite the 'potential stack memory corruption' noted in the description, the CVSS vector carries no integrity or confidentiality impact, suggesting vendors have not confirmed reliable code execution. Stack overflow exploitation for RCE may be constrained by modern mitigations (ASLR, stack canaries, NX). For RHEL deployments, this is a real but non-urgent issue unless H.265 video is routinely processed from untrusted external sources.

An attacker constructs a malicious H.265 video file embedding a buffering period SEI message with cpb_cnt_minus1 values carefully chosen to trigger more loop iterations than the stack buffer can hold, then delivers it to a target via email attachment, web download, or a streaming endpoint. A user on an affected RHEL system opens the file in a GStreamer-based media player (such as Totem, Rhythmbox with video support, or a browser using GStreamer backends), causing the parser to overflow its CPB delay stack buffer and crash the application. No public proof-of-concept exploit was identified at time of analysis, but the deterministic nature of the off-by-bound parser error makes reliable crash reproduction straightforward for a researcher familiar with H.265 bitstream structure.