---
id: CVE-2026-53702
title: >-
  Gstreamer1-plugins-bad-free: gstreamer: stack buffer overflow in h.265
  buffering period sei parser
summary: >-
  A stack buffer overflow flaw was found in the GStreamer H.265 codec parser
  library (gst-plugins-bad). When parsing a buffering period SEI message, the
  parser uses an incorrect loop bound derived from cpb_cnt_minus1[i] (the loop
  index) in…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-787
vendor: Red Hat
product: gstreamer1-plugins-bad-free
affected:
  - gstreamer1-plugins-bad-free (all versions)
  - gstreamer1-plugins-bad-free (all versions)
  - gstreamer1-plugins-bad-free (all versions)
  - gstreamer1-plugins-bad-free (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-13T02:24:39.477420Z'
published: '2026-06-11'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:43:18.379Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-53702'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-53702'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2487612'
    label: RHBZ#2487612
tags:
  - cve.org
epss: 0.00228
epssPercentile: 0.13627
ingestedAt: '2026-11-05T22:38:32.143Z'
---

## Overview

A stack buffer overflow flaw was found in the GStreamer H.265 codec parser library (gst-plugins-bad). When parsing a buffering period SEI message, the parser uses an incorrect loop bound derived from cpb_cnt_minus1[i] (the loop index) instead of the sub-layer 0 CPB count cpb_cnt_minus1[0] from the referenced Sequence Parameter Set. A crafted H.265 video file or stream can cause the parser to write beyond the bounds of stack-allocated CPB delay arrays, resulting in a crash or potential stack memory corruption.

## Affected

- `gstreamer1-plugins-bad-free (all versions)`
- `gstreamer1-plugins-bad-free (all versions)`
- `gstreamer1-plugins-bad-free (all versions)`
- `gstreamer1-plugins-bad-free (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.