diff --git a/libavcodec/cbs_h266.c b/libavcodec/cbs_h266.c
index 8c92b4f557..f0782c814b 100644
--- a/libavcodec/cbs_h266.c
+++ b/libavcodec/cbs_h266.c
@@ -143,7 +143,7 @@ static int FUNC_H266(name) args
                                         AV_INPUT_BUFFER_PADDING_SIZE); \
         if (!name ## _ref) \
             return AVERROR(ENOMEM); \
-        name = name ## _ref->data; \
+        name = (void *)name ## _ref->data; \
     } while (0)
 
 #define FUNC(name) FUNC_H266(name)
@@ -760,7 +760,17 @@ static void cbs_h266_free_sei(AVRefStructOpaque unused, void *content)
 static CodedBitstreamUnitTypeDescriptor cbs_h266_unit_types[] = {
     CBS_UNIT_TYPE_INTERNAL_REF(VVC_DCI_NUT, H266RawDCI, extension_data.data),
     CBS_UNIT_TYPE_INTERNAL_REF(VVC_OPI_NUT, H266RawOPI, extension_data.data),
-    CBS_UNIT_TYPE_INTERNAL_REF(VVC_VPS_NUT, H266RawVPS, extension_data.data),
+    {
+        .nb_unit_types     = 1,
+        .unit_type.list[0] = VVC_VPS_NUT,
+        .content_type      = CBS_CONTENT_TYPE_INTERNAL_REFS,
+        .content_size      = sizeof(H266RawVPS),
+        .type.ref          = {
+            .nb_offsets = 2,
+            .offsets    = { offsetof(H266RawVPS, vps_profile_tier_level),
+                            offsetof(H266RawVPS, extension_data.data) }
+        },
+    },
     {
         .nb_unit_types     = 1,
         .unit_type.list[0] = VVC_SPS_NUT,
diff --git a/libavcodec/cbs_h266.h b/libavcodec/cbs_h266.h
index d315f6b64a..8f7ce5f5b6 100644
--- a/libavcodec/cbs_h266.h
+++ b/libavcodec/cbs_h266.h
@@ -280,7 +280,8 @@ typedef struct H266RawVPS {
     uint8_t  vps_num_ptls_minus1;
     uint8_t  vps_pt_present_flag[VVC_MAX_PTLS];
     uint8_t  vps_ptl_max_tid[VVC_MAX_PTLS];
-    H266RawProfileTierLevel vps_profile_tier_level[VVC_MAX_PTLS];
+    H266RawProfileTierLevel *vps_profile_tier_level;
+    AVBufferRef             *vps_profile_tier_level_ref;
     uint8_t  vps_ols_ptl_idx[VVC_MAX_TOTAL_NUM_OLSS];
 
     uint16_t vps_num_dpb_params_minus1;
diff --git a/libavcodec/cbs_h266_syntax_template.c b/libavcodec/cbs_h266_syntax_template.c
index 9e0776defe..f15d70cb8d 100644
--- a/libavcodec/cbs_h266_syntax_template.c
+++ b/libavcodec/cbs_h266_syntax_template.c
@@ -930,6 +930,9 @@ static int FUNC(vps) (CodedBitstreamContext *ctx, RWContext *rw,
             return AVERROR_INVALIDDATA;
     }
 
+    allocate(current->vps_profile_tier_level,
+             (current->vps_num_ptls_minus1 + 1) *
+             sizeof(*current->vps_profile_tier_level));
     for (i = 0; i <= current->vps_num_ptls_minus1; i++) {
         CHECK(FUNC(profile_tier_level) (ctx, rw,
                                         current->vps_profile_tier_level + i,