GStreamer H266 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of H266 sei messages. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27381.

The remote NewStart CGSL host, running version MAIN 7.02, has gstreamer1-plugins-bad-free packages installed that are affected by multiple vulnerabilities:

  - A stack buffer overflow flaw was found in the GStreamer H.265 codec parser library (gst-plugins-bad). When     parsing a buffering period SEI message, the parser uses an incorrect loop bound derived from     cpb_cnt_minus1[i] (the loop index) instead of the sub-layer 0 CPB count cpb_cnt_minus1[0] from the     referenced Sequence Parameter Set. A crafted H.265 video file or stream can cause the parser to write     beyond the bounds of stack-allocated CPB delay arrays, resulting in a crash or potential stack memory     corruption. (CVE-2026-53702)

  - GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability     allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with     this library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation. The specific flaw exists within the processing of video packets. The issue results from     the lack of proper validation of user-supplied data, which can result in a write past the end of an     allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the     current process. Was ZDI-CAN-28845. (CVE-2026-2922)

  - GStreamer H266 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This     vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer.
    Interaction with this library is required to exploit this vulnerability but attack vectors may vary     depending on the implementation. The specific flaw exists within the parsing of H266 sei messages. The     issue results from the lack of proper validation of the length of user-supplied data prior to copying it     to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the     context of the current process. Was ZDI-CAN-27381. (CVE-2025-6663)

  - A denial of service vulnerability was found in GStreamer's AV1 codec parser in gst-plugins-bad. The     gst_av1_parser_parse_tile_list_obu() function passes a byte count to a bit-reader API that expects a bit     count, causing parser desynchronization. A remote attacker could trick a user into opening a specially     crafted AV1 media file, triggering an assertion abort and causing the application to crash.
    (CVE-2026-52718)

  - An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The     JPEG parser reads a segment length value from the bitstream without validating it against available data.
    A remote attacker could trick a user into opening a specially crafted JPEG file, causing downstream     parsing to read beyond the provided input buffer, leading to a crash or potential information disclosure.
    (CVE-2026-52719)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has gstreamer1 packages installed that are affected by multiple vulnerabilities:

  - GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability     allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with     this library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation. The specific flaw exists within the processing of X-QDM RTP payloads. The issue results     from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based     buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
    Was ZDI-CAN-28851. (CVE-2026-3085)

  - GStreamer H266 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This     vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer.
    Interaction with this library is required to exploit this vulnerability but attack vectors may vary     depending on the implementation. The specific flaw exists within the parsing of H266 sei messages. The     issue results from the lack of proper validation of the length of user-supplied data prior to copying it     to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the     context of the current process. Was ZDI-CAN-27381. (CVE-2025-6663)

  - GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability     allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with     this library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation. The specific flaw exists within the processing of stream headers within ASF files. The     issue results from the lack of proper validation of the length of user-supplied data prior to copying it     to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the     context of the current process. Was ZDI-CAN-28843. (CVE-2026-2920)

  - GStreamer RIFF Palette Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows     remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this     library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation. The specific flaw exists within the handling of palette data in AVI files. The issue     results from the lack of proper validation of user-supplied data, which can result in an integer overflow     before writing to memory. An attacker can leverage this vulnerability to execute code in the context of     the current process. Was ZDI-CAN-28854. (CVE-2026-2921)

  - GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability     allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with     this library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation. The specific flaw exists within the processing of video packets. The issue results from     the lack of proper validation of user-supplied data, which can result in a write past the end of an     allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the     current process. Was ZDI-CAN-28845. (CVE-2026-2922)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GStreamer H266 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This     vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer.
    Interaction with this library is required to exploit this vulnerability but attack vectors may vary     depending on the implementation. The specific flaw exists within the parsing of H266 sei messages. The     issue results from the lack of proper validation of the length of user-supplied data prior to copying it     to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the     context of the current process. Was ZDI-CAN-27381. (CVE-2025-6663)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - GStreamer H266 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This
    vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer.
    Interaction with this library is required to exploit this vulnerability but attack vectors may vary
    depending on the implementation. The specific flaw exists within the parsing of H266 sei messages. The
    issue results from the lack of proper validation of the length of user-supplied data prior to copying it
    to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the
    context of the current process. Was ZDI-CAN-27381. (CVE-2025-6663)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 69bfe2a4-5a39-11f0-8792-4ccc6adda413 advisory.

    GStreamer Security Center reports:
    It is possible for a malicious third party to trigger a buffer overflow that can                result in a crash of the application and possibly also allow code execution through                stack manipulation.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
343600	NewStart CGSL MAIN 7.02 : gstreamer1-plugins-bad-free Multiple Vulnerabilities (NS-SA-2026-0088)	Nessus	NewStart CGSL Local Security Checks	Local	high
343589	NewStart CGSL MAIN 7.02 : gstreamer1 Multiple Vulnerabilities (NS-SA-2026-0093)	Nessus	NewStart CGSL Local Security Checks	Local	high
250839	Linux Distros Unpatched Vulnerability : CVE-2025-6663	Nessus	Misc.	Local	high
428397	Alpine: multiple gst-plugins-bad packages: security update to 1.26.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
428397	Alpine: multiple gst-plugins-bad packages: security update to 1.26.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
241387	FreeBSD : gstreamer1-plugins-bad -- stack buffer overflow in H.266 video parser (69bfe2a4-5a39-11f0-8792-4ccc6adda413)	Nessus	FreeBSD Local Security Checks	Local	critical

Detections

Analytics

CVE-2025-6663

high

Tenable Plugins

high

high

high

high

high

critical