Out-of-Bounds Write Vulnerability in GStreamer's H.266 Codec Parser Library

CVE-2026-100229

What is CVE-2026-100229?

A vulnerability has been identified in GStreamer's H.266 codec parser library (libgstcodecparsers) where an out-of-bounds write occurs within the DCI parsing function. This flaw results from the incorrect acceptance of a reserved field value, allowing an attacker to exploit the vulnerability by delivering a specially crafted H.266 bitstream to affected applications that utilize the library API. While currently no standard GStreamer pipeline element triggers this code path, the potential for memory corruption or application crashes poses significant security risks.

References