GStreamer gst-plugins-bad EUVD-2026-36294

The vulnerability triggers during parsing of an H.266/VVC media file that contains a Picture Parameter Set (PPS) with multi-slice-in-tile data encoding more slices than the fixed-size arrays in GstH266PPS can accommodate - this malformed condition must be crafted intentionally. gst-plugins-bad must be installed with H.266/VVC support compiled in; systems lacking this codec are not vulnerable. User interaction is required per CVSS UI:R: a user must actively open or an automated pipeline must ingest the crafted file to invoke the parser. No prior authentication or network session is needed - file delivery alone (via any channel: web, email, file share) is sufficient to reach the vulnerable code path once the file is opened. Systems that never process H.266/VVC content have no practical exposure.

The vendor-assigned CVSS 3.1 score of 6.5 Medium (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) reflects a network-reachable, zero-privilege attack path gated only by user interaction - a user must open or stream the crafted H.266/VVC file. The UI:R requirement meaningfully constrains automated exploitation but is trivially satisfied in browser-based media players, messaging applications, or media pipelines. No EPSS data was provided, and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed large-scale or threat-actor exploitation at time of analysis. However, the description explicitly acknowledges a proof-of-concept exists and that the write primitive can exceed the initial 4-byte demonstration across multiple loop iterations. Multi-iteration contiguous heap overwrites are a well-understood primitive for heap layout manipulation and potential RCE, meaning the vendor's I:N/A:H-only CVSS assessment may understate long-term risk if the POC is refined. No EPSS score was available to supplement this judgment, and no conflicting signals are present - data gaps should be tracked.

An attacker crafts an H.266/VVC video file with a malformed PPS encoding an abnormally large slice count in multi-slice-in-tile mode, then delivers it via email attachment, a web page embedding video, or a media-sharing link. When a user on an affected RHEL system opens the file with a GStreamer-backed media player, gst_h266_parser_parse_picture_partition() iterates past the bounds of the three fixed-size arrays in GstH266PPS, overwriting adjacent heap memory. The immediate observed result is a process crash; a refined multi-iteration write targeting specific heap objects could escalate to arbitrary code execution.