CVE-2026-53701: gst-plugins-bad1.0 Out-of-bounds Write

Vulnerability summary

CVE-2026-53701 is a medium (CVSS 6.5) Out-of-bounds Write vulnerability in gst-plugins-bad1.0. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.1% of scored vulnerabilities.

Timeline

1. 11-06-2026
   PublishedVulnerability first disclosed.
2. 15-06-2026
   Last modifiedVulnerability information updated.

Description

An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser in gst-plugins-bad. In the multi-slice-in-tile processing of gst_h266_parser_parse_picture_partition() (gsth266parser.c), the loop iterates without checking that the slice index stays within bounds, writing past three fixed-size arrays (slice_height_in_ctus, slice_top_left_ctu_x, slice_top_left_ctu_y) in the GstH266PPS structure. While the initial proof-of-concept demonstrated a 4-byte out-of-bounds write, the code permits larger writes across multiple iterations. A crafted H.266/VVC media file can trigger this vulnerability.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.