Bug 2541471 (CVE-2026-100229)

Summary:	CVE-2026-100229 gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds write in gst_h266_parser_parse_dci() due to off-by-one array bound check
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	rhel-process-autobot, security-response-team, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in GStreamer's H.266 codec parser library (libgstcodecparsers). An out-of-bounds write vulnerability exists in the DCI parsing function, where a reserved field value is incorrectly accepted, causing the parser to write beyond the bounds of an internal structure. An attacker could exploit this by providing a specially crafted H.266 bitstream to a third-party application that uses this library API, potentially causing a crash or memory corruption. No standard GStreamer pipeline element currently invokes the affected code path.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2552108, 2552113
Bug Blocks:

Description OSIDB Bzimport 2026-09-25 15:28:15 UTC

GStreamer's H.266 (VVC) codec parser library (libgstcodecparsers) contains an out-of-bounds write vulnerability in gst_h266_parser_parse_dci() in gsth266parser.c (line 4812). CHECK_ALLOWED_MAX(dci->num_ptls_minus1, 15) allows value 15, but GstH266DCI.profile_tier_level[] has only 15 elements (indices 0..14). When dci_num_ptls_minus1 is 15, the loop writes past the structure via gst_h266_parse_profile_tier_level(). H.266 spec defines valid range 0..14; 15 is reserved. Fix: change bound to 14. Introduced in GStreamer 1.26. No in-tree element calls this API. Upstream report awaiting triage, no public patch. Reporter: Bruno Fournier. Tested on 1.29.2 (4cb910d) with ASan. PSIRT: PSIRTSUPT-24646.