Ramesh Adhikari

A flaw in the H.266 parser occurs when processing a malformed H.266/VVC video stream containing a crafted aspect ratio indicator value. This leads to an out-of-bounds read of up to 8 bytes from adjacent memory. An attacker can use a malicious H.266 video file or stream to leak limited memory contents through video metadata, which may expose sensitive information from the application's address space.

A flaw in the gst-plugins-bad package occurs when processing a specially crafted H.264 video file containing malformed Multiview Video Coding (MVC) or Scalable Video Coding (SVC) extension slice Network Abstraction Layer (NAL) units. A 1-byte heap out-of-bounds read can happen during parsing because the parser checks slice boundary information without verifying if the NAL unit contains sufficient data beyond the extension header. This could lead to an application crash or the leakage of a single byte of heap memory if a user opens a malicious file.