CVE-2023-40476 is a high severity (CVSS 8.8) stack-based buffer overflow in GStreamer's H.265 video parser. A malformed H.265 stream can overwrite the stack. GStreamer says gst-plugins-bad before 1.22.6 is affected, and 1.22.6 fixes it.
What's affected
The GStreamer advisory SA-2023-0008 says the affected versions are gst-plugins-bad before 1.22.6. The NVD record lists GStreamer without version numbers, so the advisory is the source for the range. The record scores the flaw 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
The weakness is CWE-121 (stack-based buffer overflow). The advisory title is: integer overflow in H.265 video parser leading to stack overwrite (GStreamer-SA-2023-0008, ZDI-CAN-21768). The record's own description calls it a stack-based buffer overflow, so the two sources describe the same bug from different angles: an integer problem as the cause and a stack overwrite as the result.
The advisory's own impact statement is more careful than the score: it says a malicious third party could trigger a crash, and possibly achieve code execution through memory manipulation. The record is not marked as a CISA Known Exploited Vulnerability, and the advisory does not say it is exploited. The fix is in the gst-plugins-bad 1.22.6 releases. People on older branches are told to apply the patch and recompile.
How to check if you're exposed
GStreamer is usually a system library, so start with the package manager. On Debian or Ubuntu style systems:
dpkg -l | grep -i gstreamer1.0-plugins-bad
gst-inspect-1.0 --version
pkg-config --modversion gstreamer-plugins-bad-1.0
On other systems use your package manager's query, or check the version your application bundles. A version below 1.22.6 is affected according to the upstream advisory. Distributions often backport fixes without changing the upstream version number, so a lower number does not prove exposure. The record links a Debian LTS announcement for that reason, and your distribution's security tracker is the right place to confirm.
Also check container images. Media libraries are often pulled in as dependencies of something else, and they travel inside base images. You can also paste a manifest into the free in-browser dependency scan at gold.safeguard.sh/scan to see which known CVEs touch your packages.
What to do now
- Inventory hosts, containers and applications that include gst-plugins-bad, directly or through a media framework.
- Update to 1.22.6 or later, or to your distribution's fixed package, and restart the services that use it.
- For builds on older branches, apply the upstream patch linked in the advisory and rebuild.
- Where media files come from users or the internet, process them in a sandboxed worker with no secrets and no unneeded network access.
- Rescan images and manifests after the update to confirm the finding is closed.
Why it matters
The record says the cause is a lack of validation of the length of user supplied data before it is copied into a fixed length buffer on the stack. Stack overflows can overwrite saved control data, which is why they are rated as code execution risks even though the advisory also mentions crashes.
The record notes that attack vectors vary with how the library is used. The library does the parsing, so the real exposure depends on where your application feeds it files or streams from outside. A thumbnailer, an upload pipeline or a media player on a desktop each look different on that question.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to patch if my application never opens H.265 files?
The vulnerable code is in a parser. If the plugin is installed and an input can be steered to it, it is reachable. If you can prove the file type is blocked upstream, urgency drops, but updating is still the cleaner answer.
Why does the record call it a stack overflow when the advisory mentions an integer overflow?
Both describe the same flaw. The advisory names the parsing bug that leads to the overwrite, and the record names the memory error that results. Weakness labels like CWE-121 describe the effect.
Sources
Last reviewed: 19 October 2026.
