Impact Analysis

The impact of this vulnerability is that an attacker could use a crafted H.266 video file or stream to cause a GStreamer-based application to leak limited memory contents.

This memory leakage could expose sensitive information from the application's address space, potentially compromising confidentiality.

However, the vulnerability does not affect the integrity or availability of the application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker to craft a malicious H.266 video file or stream that could leak limited memory contents through video metadata, potentially exposing sensitive information from the application's address space.

Such exposure of sensitive information could impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive data against unauthorized access or disclosure.

However, the CVE description does not provide specific details on the types of data that might be exposed or the extent of the impact on compliance.

Useful 0 Not Useful 0

Executive Summary

This vulnerability is a flaw in the GStreamer gst-plugins-bad package related to the processing of H.266/VVC video streams. Specifically, when the H.266 parser processes a malformed video stream with a specially crafted aspect ratio indicator value, it performs an out-of-bounds read of up to 8 bytes from adjacent memory.

An attacker can exploit this by creating a malicious H.266 video file or stream that, when processed by a GStreamer-based application, could cause the application to leak limited memory contents through video metadata.

This leakage potentially exposes sensitive information from the application's address space.

Useful 0 Not Useful 0