An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser in gst-plugins-bad. In the multi-slice-in-tile processing of gst_h266_parser_parse_picture_partition() (gsth266parser.c), the loop iterates without checking that the slice index stays within bounds, writing past three fixed-size arrays (slice_height_in_ctus, slice_top_left_ctu_x, slice_top_left_ctu_y) in the GstH266PPS structure. While the initial proof-of-concept demonstrated a 4-byte out-of-bounds write, the code permits larger writes across multiple iterations. A crafted H.266/VVC media file can trigger this vulnerability.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser in
    gst-plugins-bad. In the multi-slice-in-tile processing of gst_h266_parser_parse_picture_partition()
    (gsth266parser.c), the loop iterates without checking that the slice index stays within bounds, writing
    past three fixed-size arrays (slice_height_in_ctus, slice_top_left_ctu_x, slice_top_left_ctu_y) in the
    GstH266PPS structure. While the initial proof-of-concept demonstrated a 4-byte out-of-bounds write, the
    code permits larger writes across multiple iterations. A crafted H.266/VVC media file can trigger this
    vulnerability. (CVE-2026-53701)

The remote NewStart CGSL host, running version MAIN 7.02, has gstreamer1-plugins-bad-free packages installed that are affected by multiple vulnerabilities:

  - A stack buffer overflow flaw was found in the GStreamer H.265 codec parser library (gst-plugins-bad). When     parsing a buffering period SEI message, the parser uses an incorrect loop bound derived from     cpb_cnt_minus1[i] (the loop index) instead of the sub-layer 0 CPB count cpb_cnt_minus1[0] from the     referenced Sequence Parameter Set. A crafted H.265 video file or stream can cause the parser to write     beyond the bounds of stack-allocated CPB delay arrays, resulting in a crash or potential stack memory     corruption. (CVE-2026-53702)

  - GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability     allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with     this library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation. The specific flaw exists within the processing of video packets. The issue results from     the lack of proper validation of user-supplied data, which can result in a write past the end of an     allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the     current process. Was ZDI-CAN-28845. (CVE-2026-2922)

  - GStreamer H266 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This     vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer.
    Interaction with this library is required to exploit this vulnerability but attack vectors may vary     depending on the implementation. The specific flaw exists within the parsing of H266 sei messages. The     issue results from the lack of proper validation of the length of user-supplied data prior to copying it     to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the     context of the current process. Was ZDI-CAN-27381. (CVE-2025-6663)

  - A denial of service vulnerability was found in GStreamer's AV1 codec parser in gst-plugins-bad. The     gst_av1_parser_parse_tile_list_obu() function passes a byte count to a bit-reader API that expects a bit     count, causing parser desynchronization. A remote attacker could trick a user into opening a specially     crafted AV1 media file, triggering an assertion abort and causing the application to crash.
    (CVE-2026-52718)

  - An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The     JPEG parser reads a segment length value from the bitstream without validating it against available data.
    A remote attacker could trick a user into opening a specially crafted JPEG file, causing downstream     parsing to read beyond the provided input buffer, leading to a crash or potential information disclosure.
    (CVE-2026-52719)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21370-1 advisory.

    This update for gstreamer-plugins-bad fixes the following issues

    - CVE-2026-12891: unchecked aspect_ratio_idc value used as an array index in the H.266 parser could cause     a global out-       of-bounds read (bsc#1268872).
    - CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser (bsc#1268971).
    - CVE-2026-14935: webrtcbin accepts remote SDP without a=fingerprint due to inverted presence check     (bsc#1271051).
    - CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-     of-bounds write       (bsc#1268406).
    - CVE-2026-52721: crafted PCAP records during IPv4 or TCP header parsing could cause an out-of-bounds read       (bsc#1268408).
    - CVE-2026-52722: crafted VMnc stream with large cursor dimensions can overflow signed integer     (bsc#1268410).
    - CVE-2026-53701: multi-slice-in-tile partitions without slice index bounds checks could trigger an out-     of-bounds write       (bsc#1268172).
    - CVE-2026-53702: incorrect loop bound during H.265 SEI message parsing could result in a stack buffer     overflow       (bsc#1268168).
    - CVE-2026-59692: unvalidated peer certificate Subject DN printed during a DTLS handshake could cause a     stack buffer       overflow (bsc#1271168).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the gst package has been released.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6362 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6362-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     June 23, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : gst-plugins-bad1.0     CVE ID         : CVE-2026-52718 CVE-2026-52719 CVE-2026-53701

    Multiple security vulnerabilities were discovered in plugins for     the GStreamer media framework and its codecs and demuxers, which     may result in denial of service or potentially the execution of     arbitrary code if a malformed media file is opened.

    For the stable distribution (trixie), these problems have been fixed in     version 1.26.2-3+deb13u2.

    We recommend that you upgrade your gst-plugins-bad1.0 packages.

    For the detailed security status of gst-plugins-bad1.0 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/gst-plugins-bad1.0

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8446-1 advisory.

    It was discovered that GStreamer Bad Plugins incorrectly handled parsing H.266/VVC picture partition data.
    An attacker could use this issue to cause GStreamer Bad Plugins to crash, resulting in a denial of     service, or possibly execute arbitrary code. (CVE-2026-53701)

    It was discovered that GStreamer Bad Plugins incorrectly handled parsing H.265 buffering period metadata.
    An attacker could use this issue to cause GStreamer Bad Plugins to crash, resulting in a denial of     service, or possibly execute arbitrary code. (CVE-2026-53702)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser in     gst-plugins-bad. In the multi-slice-in-tile processing of gst_h266_parser_parse_picture_partition()     (gsth266parser.c), the loop iterates without checking that the slice index stays within bounds, writing     past three fixed-size arrays (slice_height_in_ctus, slice_top_left_ctu_x, slice_top_left_ctu_y) in the     GstH266PPS structure. While the initial proof-of-concept demonstrated a 4-byte out-of-bounds write, the     code permits larger writes across multiple iterations. A crafted H.266/VVC media file can trigger this     vulnerability. (CVE-2026-53701)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
458918	Echo: gst-plugins-bad1.0: security update to 1.26.2-3+deb13u2	Tenable Cloud Security	Echo Local Security Checks	Local	medium
458918	Echo: gst-plugins-bad1.0: security update to 1.26.2-3+deb13u2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
343600	NewStart CGSL MAIN 7.02 : gstreamer1-plugins-bad-free Multiple Vulnerabilities (NS-SA-2026-0088)	Nessus	NewStart CGSL Local Security Checks	Local	high
328916	openSUSE 16: gstreamer-plugins-bad / gstreamer-plugins-bad-chromaprint / etc (openSUSE-SU-2026:21370-1)	Nessus	SuSE Local Security Checks	Local	high
324987	Photon OS 4.0: Gst PHSA-2026-4.0-1045	Nessus	PhotonOS Local Security Checks	Local	high
322272	Debian dsa-6362 : gir1.2-gst-plugins-bad-1.0 - security update	Nessus	Debian Local Security Checks	Local	high
321649	Ubuntu 26.04 LTS : GStreamer Bad Plugins vulnerabilities (USN-8446-1)	Nessus	Ubuntu Local Security Checks	Local	medium
320826	Linux Distros Unpatched Vulnerability : CVE-2026-53701	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-53701

medium

Tenable Plugins

medium

medium

high

high

high

high

medium

medium