---
id: CVE-2026-53701
title: >-
  Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds write in h.266/vvc pps
  picture partition parser
summary: >-
  An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS
  picture partition parser in gst-plugins-bad. In the multi-slice-in-tile
  processing of gst_h266_parser_parse_picture_partition() (gsth266parser.c), the
  loop itera…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-787
vendor: Red Hat
product: gstreamer1-plugins-bad-free
affected:
  - gstreamer1-plugins-bad-free (all versions)
  - gstreamer1-plugins-bad-free (all versions)
  - gstreamer1-plugins-bad-free (all versions)
  - gstreamer1-plugins-bad-free (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-11T19:12:12.310630Z'
published: '2026-06-11'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:43:14.158Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-53701'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-53701'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2487611'
    label: RHBZ#2487611
tags:
  - cve.org
epss: 0.00206
epssPercentile: 0.10751
ingestedAt: '2026-11-05T22:38:32.142Z'
---

## Overview

An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser in gst-plugins-bad. In the multi-slice-in-tile processing of gst_h266_parser_parse_picture_partition() (gsth266parser.c), the loop iterates without checking that the slice index stays within bounds, writing past three fixed-size arrays (slice_height_in_ctus, slice_top_left_ctu_x, slice_top_left_ctu_y) in the GstH266PPS structure. While the initial proof-of-concept demonstrated a 4-byte out-of-bounds write, the code permits larger writes across multiple iterations. A crafted H.266/VVC media file can trigger this vulnerability.

## Affected

- `gstreamer1-plugins-bad-free (all versions)`
- `gstreamer1-plugins-bad-free (all versions)`
- `gstreamer1-plugins-bad-free (all versions)`
- `gstreamer1-plugins-bad-free (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.