This vulnerability involves a stack buffer overflow in the GStreamer H.265 codec parser library (gst-plugins-bad) in Red Hat Enterprise Linux 10. The parser incorrectly uses the loop index cpb_cnt_minus1[i] instead of the sub-layer 0 CPB count cpb_cnt_minus1[0] from the referenced Sequence Parameter Set when parsing buffering period SEI messages. This results in out-of-bounds writes beyond stack-allocated CPB delay arrays, potentially causing application crashes or stack memory corruption. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity. No known exploits in the wild have been reported. The vendor advisory does not explicitly state the availability of a patch or remediation status.

Exploitation of this vulnerability can cause a denial of service (application crash) or potentially allow stack memory corruption, which might be leveraged for further attacks. However, there is no indication of confidentiality or integrity impact. The vulnerability can be triggered by processing a crafted H.265 video file or stream.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-53702 for current remediation guidance. Until an official fix is available, avoid processing untrusted H.265 video files or streams with the affected GStreamer parser to mitigate risk.