{"id":"CVE-2026-53702","title":"Gstreamer1-plugins-bad-free: gstreamer: stack buffer overflow in h.265 buffering period sei parser","summary":"A stack buffer overflow flaw was found in the GStreamer H.265 codec parser library (gst-plugins-bad). When parsing a buffering period SEI message, the parser uses an incorrect loop bound derived from cpb_cnt_minus1[i] (the loop index) in…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-787"],"vendor":"Red Hat","product":"gstreamer1-plugins-bad-free","affected":["gstreamer1-plugins-bad-free (all versions)","gstreamer1-plugins-bad-free (all versions)","gstreamer1-plugins-bad-free (all versions)","gstreamer1-plugins-bad-free (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-06-13T02:24:39.477420Z"},"published":"2026-06-11","updated":"2026-11-05","sourceUpdated":"2026-11-05T21:43:18.379Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-53702","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-53702"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487612","label":"RHBZ#2487612"}],"tags":["cve.org"],"epss":0.00228,"epssPercentile":0.13627,"ingestedAt":"2026-11-05T22:38:32.143Z","slug":"CVE-2026-53702","body":"## Overview\n\nA stack buffer overflow flaw was found in the GStreamer H.265 codec parser library (gst-plugins-bad). When parsing a buffering period SEI message, the parser uses an incorrect loop bound derived from cpb_cnt_minus1[i] (the loop index) instead of the sub-layer 0 CPB count cpb_cnt_minus1[0] from the referenced Sequence Parameter Set. A crafted H.265 video file or stream can cause the parser to write beyond the bounds of stack-allocated CPB delay arrays, resulting in a crash or potential stack memory corruption.\n\n## Affected\n\n- `gstreamer1-plugins-bad-free (all versions)`\n- `gstreamer1-plugins-bad-free (all versions)`\n- `gstreamer1-plugins-bad-free (all versions)`\n- `gstreamer1-plugins-bad-free (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nMitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}