CVE-2026-119728
Gst-plugins-bad: gst-plugins-bad: null pointer dereference in h.264 mvc sps cleanup during parse failure
A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file or network stream with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer during the cleanup of partially allocated internal structures after a parse failure. This can cause the application using GStreamer to crash, resulting in a denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Gst-plugins-bad: gst-plugins-bad: null pointer dereference in h.264 mvc sps cleanup during parse failure
A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file or network stream with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer during the cleanup of partially allocated internal structures after a parse failure. This can cause the application using GStreamer to crash, resulting in a denial of service.
- Record
CVE-2026-119728- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-05
EUVDEUVD-2026-114318
A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file or network stream with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer during the cleanup of partially allocated internal structures after a parse failure. This can cause the application using GStreamer to crash, resulting in a denial of service.
- Record
EUVD-2026-114318- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-r374-jvgj-7922
A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially...
A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer during the cleanup of partially allocated internal structures after a parse failure. This can cause the application using GStreamer to crash, resulting in a denial of service.
- Record
GHSA-r374-jvgj-7922- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
NVD
A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file or network stream with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer during the cleanup of partially allocated internal structures after a parse failure. This can cause the application using GStreamer to crash, resulting in a denial of service.
- Record
CVE-2026-119728- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-119728
A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file or network stream with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer during the cleanup of partially allocated internal structures after a parse failure. This can cause the application using GStreamer to crash, resulting in a denial of service.
- Record
DEBIAN-CVE-2026-119728- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
OSVUBUNTU-CVE-2026-119728
A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer during the cleanup of partially allocated internal structures after a parse failure. This can cause the application using GStreamer to crash, resulting in a denial of service.
- Record
UBUNTU-CVE-2026-119728- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gst-plugins-bad1.0Debian:12 |
All versions, plus listed versions 1.22.0-41.22.0-4+deb12u11.22.0-4+deb12u21.22.0-4+deb12u31.22.0-4+deb12u4 Show 45 moreShow less1.22.0-4+deb12u51.22.0-4+deb12u61.22.0-4+deb12u71.22.0-4+deb12u81.22.1-11.22.10-11.22.3-11.22.3-21.22.4-11.22.7-11.22.8-11.22.9-11.22.9-21.23.1-11.23.2-11.23.90-11.24.0-11.24.1-11.24.1-21.24.1-31.24.1-41.24.10-11.24.10-21.24.10-2+hurd.11.24.10-31.24.11-11.24.11-21.24.11-31.24.12-11.24.12-21.24.12-31.24.2-11.24.2-21.24.2-31.24.2-41.24.3-11.24.4-11.24.4-21.24.5-11.24.6-11.24.7-11.24.8-11.24.8-21.24.9-11.25.1-1 |
None known |
gst-plugins-bad1.0Debian:13 |
All versions, plus listed versions 1.26.10-11.26.10-21.26.2-31.26.2-3+deb13u11.26.2-3+deb13u2 Show 37 moreShow less1.26.2-3+deb13u31.26.3-11.26.4-11.26.5-11.26.5-21.26.6-11.26.6-21.26.6-31.26.6-41.26.6-51.26.7-11.26.7-21.26.8-11.26.9-11.27.1-11.27.2-11.27.50-11.27.90-11.27.90-21.27.90-31.28.0-11.28.1-11.28.1-21.28.1-31.28.2-11.28.2-21.28.3-11.28.4-11.28.5-11.28.5-21.28.6-11.28.7-11.28.7-21.28.8-11.29.1-11.29.2-11.29.2-2 |
None known |
gst-plugins-bad1.0Debian:14 |
before 1.28.2-1, plus listed versions 1.26.10-11.26.10-21.26.2-31.26.3-11.26.4-1 Show 21 moreShow less1.26.5-11.26.5-21.26.6-11.26.6-21.26.6-31.26.6-41.26.6-51.26.7-11.26.7-21.26.8-11.26.9-11.27.1-11.27.2-11.27.50-11.27.90-11.27.90-21.27.90-31.28.0-11.28.1-11.28.1-21.28.1-3 |
1.28.2-1 |
gst-plugins-bad1.0Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.2.0-3ubuntu51.2.1-1ubuntu11.2.1-1ubuntu21.2.2-1ubuntu11.2.2-1ubuntu2 Show 6 moreShow less1.2.2-1ubuntu41.2.3-1ubuntu11.2.3-1ubuntu21.2.4-1~ubuntu11.2.4-1~ubuntu1.11.2.4-1~ubuntu1.1+esm1 |
None known |
gst-plugins-bad1.0Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.6.0-1ubuntu11.6.1-1ubuntu11.6.2-1ubuntu11.7.1-1ubuntu11.7.1-1ubuntu3 Show 11 moreShow less1.7.1-1ubuntu41.7.2-1ubuntu11.7.90-1ubuntu21.7.91-1ubuntu11.8.0-1ubuntu11.8.1-1ubuntu0.11.8.2-1ubuntu0.11.8.2-1ubuntu0.21.8.3-1ubuntu0.21.8.3-1ubuntu0.2+esm11.8.3-1ubuntu0.2+esm2 |
None known |
gst-plugins-bad1.0Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.12.3-1ubuntu11.12.3-1ubuntu21.12.3-2ubuntu11.12.4-2ubuntu11.12.4-2ubuntu2 Show 8 moreShow less1.13.1-1ubuntu11.13.91-1ubuntu11.14.0-1ubuntu11.14.1-1ubuntu1~ubuntu18.04.11.14.4-1ubuntu1~ubuntu18.04.11.14.5-0ubuntu1~18.04.11.14.5-0ubuntu1~18.04.1+esm11.14.5-0ubuntu1~18.04.1+esm2 |
None known |
gst-plugins-bad1.0Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.16.1-1ubuntu11.16.1-1ubuntu31.16.1-1ubuntu41.16.1-1ubuntu51.16.1-1ubuntu6 Show 9 moreShow less1.16.1-1ubuntu81.16.2-1ubuntu11.16.2-1ubuntu21.16.2-2ubuntu11.16.2-2.1ubuntu11.16.3-0ubuntu11.16.3-0ubuntu1.11.16.3-0ubuntu1.1+esm11.16.3-0ubuntu1.1+esm2 |
None known |
gst-plugins-bad1.0Ubuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.18.5-1ubuntu11.18.5-1ubuntu31.20.0-2ubuntu21.20.1-1ubuntu21.20.3-0ubuntu11.20.3-0ubuntu1.11.20.3-0ubuntu1.1+esm21.20.3-0ubuntu1.1+esm3 |
None known |
gst-plugins-bad1.0Ubuntu:Pro:24.04:LTS |
All versions, plus listed versions 1.22.4-1ubuntu11.22.4-1ubuntu21.22.4-1ubuntu41.22.9-2ubuntu11.24.0-1ubuntu3 Show 4 moreShow less1.24.0-1ubuntu41.24.2-1ubuntu41.24.2-1ubuntu4+esm11.24.2-1ubuntu4+esm2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| description | CVE List, OSV | |
| affected, aliases, references | NVD, OSV | |
| products | EUVD | |
| facts, severity | CVE List, EUVD, NVD | |
| products | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-119728 is a medium vulnerability (CVSS 6.5) in Red Hat Enterprise Linux 10, published October 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in gst-plugins-bad1.0 1.28.2-1.
References
Left out here: 49 versions. The JSON record has them.