GStreamer's gst-plugins-bad provides the H.265 (HEVC) bitstream parser in subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gsth265parser.c. In the function gst_h265_parse_sps_ext() at approximately line 2297, when parsing the SPS SCC (Screen Content Coding) extension, the code computes the upper bound for sps_num_palette_predictor_initializer_minus1 as 'palette_max_size + delta_palette_max_predictor_size - 1'. If an attacker crafts a bitstream where both palette_max_size and delta_palette_max_predictor_size are 0 (legal values per their individual READ_UE_MAX constraints), this subtraction produces 0xFFFFFFFF via unsigned integer underflow. The READ_UE_MAX macro checks 'val > max' using guint32 comparison, so 0xFFFFFFFF as max accepts any guint32 value. The field sps_num_palette_predictor_initializer_minus1 is stored in a guint8, so the value is truncated to 0..255. If the truncated value exceeds 127, the subsequent loop 'for (i = 0; i < num; i++) READ_UINT32(nr, sps_palette_predictor_initializer[comp][i], num_bits)' writes past the end of the guint32 sps_palette_predictor_initializer[3][128] array, causing a heap buffer overflow into adjacent GstH265SPSSCCExtensionParams and GstH265SPS struct members. This corrupts the GstH265SPS object stored in the parser's static sps[] array.

Affected versions: gst-plugins-bad < 1.28.1.
Fix: gst-plugins-bad 1.28.1 adds a guard 'if (palette_max_size + delta_palette_max_predictor_size == 0) goto error' before the bound computation.
Advisory: GStreamer-SA-2026-0012.
Reporter: GStreamer project (upstream self-reported).