--- a/media/parsers/h265_parser.cc
+++ b/media/parsers/h265_parser.cc
@@ -719,9 +719,10 @@ H265Parser::Result H265Parser::ParseSPS(int* sps_id) {
   }

   READ_UE_OR_RETURN(&sps->log2_min_luma_coding_block_size_minus3);
-  // This enforces that min_cb_log2_size_y below will be <= 30 and prevents
-  // integer overflow math there.
-  TRUE_OR_RETURN(sps->log2_min_luma_coding_block_size_minus3 <= 27);
+  // H.265 7.4.3.2.1: log2_min_luma_coding_block_size_minus3 shall be in [0,3].
+  // Downstream VAAPI/V4L2 drivers assume spec-conformant values; do not let
+  // out-of-spec exponents reach SubmitFrameMetadata().
+  IN_RANGE_OR_RETURN(sps->log2_min_luma_coding_block_size_minus3, 0, 3);
   READ_UE_OR_RETURN(&sps->log2_diff_max_min_luma_coding_block_size);

   int min_cb_log2_size_y = sps->log2_min_luma_coding_block_size_minus3 + 3;
@@ -731,7 +732,9 @@ H265Parser::Result H265Parser::ParseSPS(int* sps_id) {
     return kInvalidStream;

   sps->ctb_log2_size_y = ctb_log2_size_y.ValueOrDefault(0);
-  TRUE_OR_RETURN(sps->ctb_log2_size_y <= 30);
+  // H.265 Annex A: CtbLog2SizeY shall be in [4,6]. ffmpeg enforces this; we
+  // must too, since the value is forwarded verbatim to libva / V4L2 drivers.
+  IN_RANGE_OR_RETURN(sps->ctb_log2_size_y, 4, 6);
   int min_cb_size_y = 1 << min_cb_log2_size_y;
   int ctb_size_y = 1 << sps->ctb_log2_size_y;
   sps->pic_width_in_ctbs_y = base::ClampCeil(