CVE-2026-100229: Out-of-bounds Write in Red Hat Red Hat Enterprise Linux 10
Description
A flaw was found in GStreamer's H.266 codec parser library (libgstcodecparsers). An out-of-bounds write vulnerability exists in the DCI parsing function, where a reserved field value is incorrectly accepted, causing the parser to write beyond the bounds of an internal structure. An attacker could exploit this by providing a specially crafted H.266 bitstream to a third-party application that uses this library API, potentially causing a crash or memory corruption. No standard GStreamer pipeline element currently invokes the affected code path.
CVSS v3.1
Score 6.5medium
Affected software
Red Hat
Red Hat Enterprise Linux 10
Red Hat
Red Hat Enterprise Linux 7
Red Hat
Red Hat Enterprise Linux 8
Red Hat
Red Hat Enterprise Linux 9
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
An out-of-bounds write vulnerability exists in the DCI parsing function of GStreamer's H.266 codec parser library (libgstcodecparsers) due to acceptance of an incorrect reserved field value. This causes writes beyond the bounds of an internal structure. An attacker can exploit this by supplying a malicious H.266 bitstream to a third-party application that uses this library API, potentially causing a crash or memory corruption. However, no standard GStreamer pipeline element currently invokes this vulnerable code path, limiting immediate exposure.
Potential Impact
Successful exploitation could lead to application crashes or memory corruption in third-party applications using the vulnerable GStreamer H.266 codec parser library. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-100229 for current remediation guidance. Since no standard GStreamer pipeline element currently triggers this vulnerability, immediate risk is limited unless third-party applications explicitly use the affected API. Monitor vendor updates for patches.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-09-25T15:24:07.433Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-100229","vendor":"Red Hat"}]
Threat ID: 6acf5a922cdf04f6566d029f
Added to database: 10/14/2026, 10:33:54 UTC
Last enriched: 10/14/2026, 10:49:04 UTC
Last updated: 10/14/2026, 19:00:33 UTC
Views: 18
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.