CVE-2026-53702: Out-of-bounds Write in Red Hat Red Hat Enterprise Linux 10
A stack buffer overflow flaw was found in the GStreamer H.265 codec parser library (gst-plugins-bad). When parsing a buffering period SEI message, the parser uses an incorrect loop bound derived from cpb_cnt_minus1[i] (the loop index) instead of the sub-layer 0 CPB count cpb_cnt_minus1[0] from the referenced Sequence Parameter Set. A crafted H.265 video file or stream can cause the parser to write beyond the bounds of stack-allocated CPB delay arrays, resulting in a crash or potential stack memory corruption.
AI Analysis
Technical Summary
A stack buffer overflow exists in the GStreamer H.265 codec parser library (gst-plugins-bad) in Red Hat Enterprise Linux 10. The parser incorrectly uses the loop index cpb_cnt_minus1[i] instead of the sub-layer 0 CPB count cpb_cnt_minus1[0] from the referenced Sequence Parameter Set when parsing buffering period SEI messages. This results in writes beyond the bounds of stack-allocated CPB delay arrays, potentially causing a crash or stack memory corruption. The vulnerability is remotely exploitable without privileges but requires user interaction (e.g., opening a crafted video file). The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, reflecting no confidentiality or integrity impact but high availability impact. The vendor advisory does not specify a patch or fix status as of the publication date.
Potential Impact
Successful exploitation can cause a denial of service via application crash or potentially lead to stack memory corruption. There is no direct confidentiality or integrity impact reported. The vulnerability requires user interaction to trigger and can be exploited remotely over the network by processing a crafted H.265 video stream or file.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-53702 for current remediation guidance. Until a fix is available, avoid processing untrusted H.265 video files or streams with the affected GStreamer plugin to mitigate risk.
CVE-2026-53702: Out-of-bounds Write in Red Hat Red Hat Enterprise Linux 10
Description
A stack buffer overflow flaw was found in the GStreamer H.265 codec parser library (gst-plugins-bad). When parsing a buffering period SEI message, the parser uses an incorrect loop bound derived from cpb_cnt_minus1[i] (the loop index) instead of the sub-layer 0 CPB count cpb_cnt_minus1[0] from the referenced Sequence Parameter Set. A crafted H.265 video file or stream can cause the parser to write beyond the bounds of stack-allocated CPB delay arrays, resulting in a crash or potential stack memory corruption.
CVSS v3.1
Score 6.5medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
A stack buffer overflow exists in the GStreamer H.265 codec parser library (gst-plugins-bad) in Red Hat Enterprise Linux 10. The parser incorrectly uses the loop index cpb_cnt_minus1[i] instead of the sub-layer 0 CPB count cpb_cnt_minus1[0] from the referenced Sequence Parameter Set when parsing buffering period SEI messages. This results in writes beyond the bounds of stack-allocated CPB delay arrays, potentially causing a crash or stack memory corruption. The vulnerability is remotely exploitable without privileges but requires user interaction (e.g., opening a crafted video file). The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, reflecting no confidentiality or integrity impact but high availability impact. The vendor advisory does not specify a patch or fix status as of the publication date.
Potential Impact
Successful exploitation can cause a denial of service via application crash or potentially lead to stack memory corruption. There is no direct confidentiality or integrity impact reported. The vulnerability requires user interaction to trigger and can be exploited remotely over the network by processing a crafted H.265 video stream or file.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-53702 for current remediation guidance. Until a fix is available, avoid processing untrusted H.265 video files or streams with the affected GStreamer plugin to mitigate risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-06-10T15:40:26.501Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-53702","vendor":"Red Hat"}]
Threat ID: 6a2b05db815e7002b81eca08
Added to database: 06/11/2026, 19:00:43 UTC
Last enriched: 06/19/2026, 18:19:16 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 95
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.