CVE-2026-53702 Details
Description
A stack buffer overflow flaw was found in the GStreamer H.265 codec parser library (gst-plugins-bad). When parsing a buffering period SEI message, the parser uses an incorrect loop bound derived from cpb_cnt_minus1[i] (the loop index) instead of the sub-layer 0 CPB count cpb_cnt_minus1[0] from the referenced Sequence Parameter Set. A crafted H.265 video file or stream can cause the parser to write beyond the bounds of stack-allocated CPB delay arrays, resulting in a crash or potential stack memory corruption.
A stack buffer overflow vulnerability has been identified in the GStreamer H.265 codec parser library, specifically in the 'gst-plugins-bad' package. The issue arises when the parser processes a buffering period SEI message. It incorrectly uses the loop index 'cpb_cnt_minus1[i]' to determine the loop bound, instead of referencing the sub-layer 0 CPB count 'cpb_cnt_minus1[0]' from the Sequence Parameter Set. This flaw allows a crafted H.265 video file or stream to manipulate the parser into writing beyond the limits of stack-allocated CPB delay arrays. The result is a crash or potential corruption of stack memory.
The vulnerability has been fixed in GStreamer version 1.28.3. Users should upgrade to this version.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-53702 | [email protected] | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2487612 | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 11, 2026 | New CVE Received | [email protected] |