CVE-2026-53701 is an out-of-bounds write vulnerability in the gst_h266_parser_parse_picture_partition() function of GStreamer's H.266/VVC PPS picture partition parser within gst-plugins-bad. The vulnerability arises because the loop that processes multiple slices in a tile does not verify that the slice index remains within the bounds of three fixed-size arrays (slice_height_in_ctus, slice_top_left_ctu_x, slice_top_left_ctu_y) in the GstH266PPS structure. This allows writing past the allocated array boundaries. The initial proof-of-concept demonstrated a 4-byte out-of-bounds write, but the code logic permits larger writes across multiple iterations. A maliciously crafted H.266/VVC media file can exploit this flaw to cause an out-of-bounds write.

The vulnerability can cause an out-of-bounds write leading to potential denial of service or other undefined behavior affecting application stability. The CVSS vector indicates the attack requires network access with low complexity, no privileges, and user interaction. The impact is limited to availability (A:H) with no confidentiality or integrity impact reported.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-53701 for current remediation guidance. No official fix or workaround is explicitly stated in the provided advisory content. Users should monitor the vendor advisory for updates and apply any released patches promptly.