CVE-2026-100229

Name of the Vulnerable Software and Affected Versions GStreamer (affected versions not specified)

Description A flaw exists in the H.266 codec parser library (libgstcodecparsers). An out-of-bounds write occurs in the gst h266 parser parse dci() function when a reserved field value is incorrectly accepted, leading the parser to write beyond the bounds of an internal structure. An attacker can trigger this by providing a specially crafted H.266 bitstream to a third-party application utilizing this library API, which may result in memory corruption or a crash. No standard GStreamer pipeline element currently invokes the affected code path.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.