Faruk Kazi

**Name of the Vulnerable Software and Affected Versions** GStreamer gst-plugins-bad (affected versions not specified) **Description** A flaw in the H.266 parser occurs when processing a malformed H.266/VVC video stream containing a crafted aspect ratio indicator value. This leads to an out-of-bounds read of up to 8 bytes from adjacent memory. An attacker can use a malicious H.266 video file or stream to leak limited memory contents through video metadata, which may expose sensitive information from the application's address space. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mitsubishi Electric India GC-ENET-COM versions with the first 2 digits of the 11-digit serial number of the unit being "16" **Description** The issue is related to a Signal Handler Race Condition that allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition in Ethernet communication. This is achieved by sending a large number of specially crafted packets to any UDP port when the GC-ENET-COM is configured as a Modbus TCP Server. The communication resumes only when the power of the main unit is turned off and on or when the GC-ENET-COM is hot-swapped from the main unit. **Recommendations** For Mitsubishi Electric India GC-ENET-COM versions with the first 2 digits of the 11-digit serial number of the unit being "16", as a temporary workaround, consider restricting access to UDP ports when the GC-ENET-COM is configured as a Modbus TCP Server until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.