Out-of-bounds read in gst-plugins-bad and gstreamer - CVE-2026-53701

Vulnerability identifier: #VU141125

CSH Severity: Medium

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-53701

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the H.266/VVC codec parser (gsth266parser) when parsing Picture Parameter Set (PPS) tile slices. A remote attacker can provide a crafted H.266/VVC video stream with a large picture dimension and an excessive number of explicitly signalled slices per tile to disclose sensitive information or cause a denial of service.

gst-plugins-bad
gstreamer
Debian Linux
Anolis OS
gst-plugins-bad1.0 (Debian package)
gstreamer1-plugins-bad-free
gstreamer1-plugins-bad-free-devel
gstreamer1-plugins-bad-free-libs
gstreamer1-plugins-bad-free-doc

Install security update from vendor's website.

gst-plugins-bad - update to 1.28.5
gstreamer - update to 1.28.5
gst-plugins-bad1.0 (Debian package) - update to 1.26.2-3+deb13u2
gstreamer1-plugins-bad-free - update to 1.28.1-4
gstreamer1-plugins-bad-free-devel - update to 1.28.1-4
gstreamer1-plugins-bad-free-libs - update to 1.28.1-4
gstreamer1-plugins-bad-free-doc - update to 1.28.1-4

• https://gstreamer.freedesktop.org/security/sa-2026-0055.html
• https://gstreamer.freedesktop.org

• Multiple vulnerabilities in GStreamer
• Debian update for gst-plugins-bad1.0
• Anolis OS update for gstreamer1-plugins-bad-free