Bug 2541471 (CVE-2026-100229) - CVE-2026-100229 gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds write in gst_h266_parser_parse_dci() due to off-by-one array bound check
Summary: CVE-2026-100229 gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out...
Keywords:
Status: NEW
Alias: CVE-2026-100229
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2552108 2552113
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-25 15:28 UTC by OSIDB Bzimport
Modified: 2026-10-14 08:16 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-25 15:28:15 UTC 
GStreamer's H.266 (VVC) codec parser library (libgstcodecparsers) contains an out-of-bounds write vulnerability in gst_h266_parser_parse_dci() in gsth266parser.c (line 4812). CHECK_ALLOWED_MAX(dci->num_ptls_minus1, 15) allows value 15, but GstH266DCI.profile_tier_level[] has only 15 elements (indices 0..14). When dci_num_ptls_minus1 is 15, the loop writes past the structure via gst_h266_parse_profile_tier_level(). H.266 spec defines valid range 0..14; 15 is reserved. Fix: change bound to 14. Introduced in GStreamer 1.26. No in-tree element calls this API. Upstream report awaiting triage, no public patch. Reporter: Bruno Fournier. Tested on 1.29.2 (4cb910d) with ASan. PSIRT: PSIRTSUPT-24646.
Note You need to log in before you can comment on or make changes to this bug.