CVE catalog

CVE-2026-53702

A stack buffer overflow flaw was found in the GStreamer H.265 codec parser library (gst-plugins-bad). When parsing a buffering period SEI message, the parser uses an incorrect loop bound derived from

[CVE catalog]

Severity: Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published: May 11, 2026, 10:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.23% · Oct 25, 2026

A stack buffer overflow flaw was found in the GStreamer H.265 codec parser library (gst-plugins-bad). When parsing a buffering period SEI message, the parser uses an incorrect loop bound derived from cpb_cnt_minus1[i] (the loop index) instead of the sub-layer 0 CPB count cpb_cnt_minus1[0] from the referenced Sequence Parameter Set. A crafted H.265 video file or stream can cause the parser to write beyond the bounds of stack-allocated CPB delay arrays, resulting in a crash or potential stack memory corruption.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	gst-plugins-bad1.0	sid	`1.28.8-1`	fixed
Debian	gst-plugins-bad1.0	forky	`1.28.8-1`	fixed
Debian	gst-plugins-bad1.0	trixie	`1.26.2-3+deb13u3`	vulnerable
Debian	gst-plugins-bad1.0	trixie-security	`1.26.2-3+deb13u3`	vulnerable
Debian	gst-plugins-bad1.0	bookworm	`1.22.0-4+deb12u7`	vulnerable
Debian	gst-plugins-bad1.0	bookworm-security	`1.22.0-4+deb12u8`	fixed
Cpe	gst-plugins-bad1.0	Not reported	Not reported	vulnerable
Ubuntu	gst-plugins-bad1.0	pro	`1.22.4-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-bad1.0	pro	`1.22.4-1ubuntu2`	vulnerable
Ubuntu	gst-plugins-bad1.0	pro	`1.22.4-1ubuntu4`	vulnerable
Ubuntu	gst-plugins-bad1.0	pro	`1.22.9-2ubuntu1`	vulnerable
Ubuntu	gst-plugins-bad1.0	pro	`1.24.0-1ubuntu3`	vulnerable
Ubuntu	gst-plugins-bad1.0	pro	`1.24.0-1ubuntu4`	vulnerable
Ubuntu	gst-plugins-bad1.0	pro	`1.24.2-1ubuntu4`	vulnerable
Ubuntu	gst-plugins-bad1.0	pro	`1.24.2-1ubuntu4+esm1`	vulnerable
Ubuntu	gst-plugins-bad1.0	pro	`1.24.2-1ubuntu4+esm2`	vulnerable
Ubuntu	gst-plugins-bad1.0	25.10	`1.26.0-1ubuntu2`	vulnerable
Ubuntu	gst-plugins-bad1.0	25.10	`1.26.2-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-bad1.0	25.10	`1.26.3-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-bad1.0	25.10	`1.26.4-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-bad1.0	25.10	`1.26.5-1ubuntu2`	vulnerable
Ubuntu	gst-plugins-bad1.0	26.04	`1.26.5-1ubuntu2`	vulnerable
Ubuntu	gst-plugins-bad1.0	26.04	`1.27.2-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-bad1.0	26.04	`1.27.90-1ubuntu2`	vulnerable
Ubuntu	gst-plugins-bad1.0	26.04	`1.28.0-1ubuntu2`	vulnerable
Ubuntu	gst-plugins-bad1.0	26.04	`1.28.1-2ubuntu2`	vulnerable
Ubuntu	gst-plugins-bad1.0	26.04	`1.28.1-2ubuntu3`	vulnerable
Ubuntu	gst-plugins-bad1.0	26.04	`1.28.2-1ubuntu1`	vulnerable
Ubuntu	gst-plugins-bad1.0	26.04	`1.28.2-1ubuntu1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	gst-plugins-bad1.0	source	sid	`1.28.3-1`	not yet assigned	Not reported	Not reported
Debian	gst-plugins-bad1.0	source	forky	`1.28.3-1`	not yet assigned	Not reported	Not reported
Debian	gst-plugins-bad1.0	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	gst-plugins-bad1.0	source	bookworm	`1.22.0-4+deb12u8`	not yet assigned	Not reported	Not reported
Ubuntu	gst-plugins-bad1.0	deb	26.04	`1.28.2-1ubuntu1.1`	Not reported	UBUNTU-CVE-2026-53702	Not reported

Notes

[trixie] gst-plugins-bad1.0: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[gir1.2-gst-plugins-bad-1.0]Affected
Source package: [gst-plugins-bad1.0]
Details (4)
- 1.22.0-4+deb12u7 · amd64 · bookworm
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm
- 1.22.0-4+deb12u7 · arm64 · bookworm
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm
- 1.22.0-4+deb12u7 · amd64 · bookworm-security
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm
- 1.22.0-4+deb12u7 · arm64 · bookworm-security
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm
[gstreamer1.0-opencv]Affected
Source package: [gst-plugins-bad1.0]
Details (4)
- 1.22.0-4+deb12u7 · amd64 · bookworm
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm
- 1.22.0-4+deb12u7 · arm64 · bookworm
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm
- 1.22.0-4+deb12u7 · amd64 · bookworm-security
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm
- 1.22.0-4+deb12u7 · arm64 · bookworm-security
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm
[gstreamer1.0-plugins-bad]Affected
Source package: [gst-plugins-bad1.0]
Details (4)
- 1.22.0-4+deb12u7 · amd64 · bookworm
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm
- 1.22.0-4+deb12u7 · arm64 · bookworm
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm
- 1.22.0-4+deb12u7 · amd64 · bookworm-security
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm
- 1.22.0-4+deb12u7 · arm64 · bookworm-security
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm
[gstreamer1.0-plugins-bad-apps]Affected
Source package: [gst-plugins-bad1.0]
Details (4)
- 1.22.0-4+deb12u7 · amd64 · bookworm
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm
- 1.22.0-4+deb12u7 · arm64 · bookworm
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm
- 1.22.0-4+deb12u7 · amd64 · bookworm-security
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm
- 1.22.0-4+deb12u7 · arm64 · bookworm-security
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm
[gstreamer1.0-wpe]Affected
Source package: [gst-plugins-bad1.0]
Details (4)
- 1.22.0-4+deb12u7 · amd64 · bookworm
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm
- 1.22.0-4+deb12u7 · arm64 · bookworm
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm
- 1.22.0-4+deb12u7 · amd64 · bookworm-security
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm
- 1.22.0-4+deb12u7 · arm64 · bookworm-security
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm
[libgstreamer-opencv1.0-0]Affected
Source package: [gst-plugins-bad1.0]
Details (4)
- 1.22.0-4+deb12u7 · amd64 · bookworm
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm
- 1.22.0-4+deb12u7 · arm64 · bookworm
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm
- 1.22.0-4+deb12u7 · amd64 · bookworm-security
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm
- 1.22.0-4+deb12u7 · arm64 · bookworm-security
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm
[libgstreamer-plugins-bad1.0-0]Affected
Source package: [gst-plugins-bad1.0]
Details (4)
- 1.22.0-4+deb12u7 · amd64 · bookworm
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm
- 1.22.0-4+deb12u7 · arm64 · bookworm
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm
- 1.22.0-4+deb12u7 · amd64 · bookworm-security
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm
- 1.22.0-4+deb12u7 · arm64 · bookworm-security
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm
[libgstreamer-plugins-bad1.0-dev]Affected
Source package: [gst-plugins-bad1.0]
Details (4)
- 1.22.0-4+deb12u7 · amd64 · bookworm
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm
- 1.22.0-4+deb12u7 · arm64 · bookworm
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm
- 1.22.0-4+deb12u7 · amd64 · bookworm-security
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm
- 1.22.0-4+deb12u7 · arm64 · bookworm-security
  Affected · Fixed: 1.22.0-4+deb12u8
  nvd · gst-plugins-bad1.0 · debian · bookworm

Observed: Oct 27, 2026, 7:35:10 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]