CVE-2026-53701

Name	CVE-2026-53701
Description	An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser in gst-plugins-bad. In the multi-slice-in-tile processing of gst_h266_parser_parse_picture_partition() (gsth266parser.c), the loop iterates without checking that the slice index stays within bounds, writing past three fixed-size arrays (slice_height_in_ctus, slice_top_left_ctu_x, slice_top_left_ctu_y) in the GstH266PPS structure. While the initial proof-of-concept demonstrated a 4-byte out-of-bounds write, the code permits larger writes across multiple iterations. A crafted H.266/VVC media file can trigger this vulnerability.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
gst-plugins-bad1.0 (PTS)	bullseye	1.18.4-3+deb11u4	vulnerable
	bullseye (security)	1.18.4-3+deb11u6	vulnerable
	bookworm, bookworm (security)	1.22.0-4+deb12u7	vulnerable
	trixie (security), trixie	1.26.2-3+deb13u1	vulnerable
	forky, sid	1.28.3-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
gst-plugins-bad1.0	source	(unstable)	1.28.3-1

Notes

https://gstreamer.freedesktop.org/security/sa-2026-0026.html
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11581
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/f66e8292edbc50c5404b0a4ec8003eb6bc008977 (main)
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/3a02a89e05eb866f98eeccdd83db4fc3223e86fc (1.26 branch)