CVE-2026-53701 Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds write in h.266/vvc pps picture partition parser
A crafted H.266/VVC media file triggers an out-of-bounds write in GStreamer's parser, potentially allowing code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-53701?
CVE-2026-53701 is a medium-severity memory corruption vulnerability in Red Hat Enterprise Linux 10, published on 11 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser in gst-plugins-bad. In the multi-slice-in-tile processing of gst_h266_parser_parse_picture_partition() (gsth266parser.c), the loop iterates without checking that the slice index stays within bounds, writing past three fixed-size arrays (slice_height_in_ctus, slice_top_left_ctu_x, slice_top_left_ctu_y) in the GstH266PPS structure. While the initial proof-of-concept demonstrated a 4-byte out-of-bounds write, the code permits larger writes across multiple iterations. A crafted H.266/VVC media file can trigger this vulnerability.
Weakness: CWE-787
Which versions are affected by CVE-2026-53701?
How do I fix CVE-2026-53701?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-53701 being exploited?
There is no known exploitation of CVE-2026-53701 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-53701, ECHO-adf0-6d60-f6d3, GHSA-2f39-4x7j-f7fp, UBUNTU-CVE-2026-53701.