GStreamer Security Advisory GStreamer-SA-2026-0017 reports an integer overflow in the gst-plugins-bad H.266/VVC parser while parsing profile, tier, and level fields from malformed H.266 streams. The resulting stack-based buffer overflow may crash an application processing malicious media and could possibly allow code execution. Upstream lists gst-plugins-bad versions 1.25.1 through versions before 1.28.2 as affected; version 1.28.2 contains the fix. The local verification report confirmed the code pattern by static analysis but did not confirm the exact exploit path.