CVE-2026-12893

No scoreFix available

[gstreamer1-libav: gstreamer1-libav: NULL pointer dereference in gstavdemux.c error handler]

What each source reports

OSVUBUNTU-CVE-2026-12893 No score

[gstreamer1-libav: gstreamer1-libav: NULL pointer dereference in gstavdemux.c error handler]

Record: UBUNTU-CVE-2026-12893
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`gst-libav1.0` Debian:12	All versions, plus listed versions 1.22.0-21.22.1-11.22.10-11.22.2-11.22.3-1 Show 45 moreShow less 1.22.3-21.22.4-11.22.5-11.22.6-11.22.7-11.22.8-11.22.9-11.23.1-11.23.2-11.23.90-11.24.0-11.24.1-11.24.10-11.24.11-11.24.12-11.24.2-11.24.3-11.24.3-21.24.4-11.24.5-11.24.6-11.24.7-11.24.8-11.24.9-11.25.1-11.25.1-21.25.50-11.25.90-11.25.90-21.26.0-11.26.1-11.26.10-11.26.2-11.26.3-11.26.4-11.26.5-11.26.5-21.26.6-11.26.7-11.26.7-21.26.8-11.26.9-11.27.1-11.27.2-11.27.50-1	None known
`gst-libav1.0` Debian:13	All versions, plus listed versions 1.26.10-11.26.2-11.26.2-1+deb13u11.26.3-11.26.4-1 Show 21 moreShow less 1.26.5-11.26.5-21.26.6-11.26.7-11.26.7-21.26.8-11.26.9-11.27.1-11.27.2-11.27.50-11.27.50-21.27.90-11.28.0-11.28.1-11.28.2-11.28.3-11.28.4-11.28.5-11.28.6-11.29.1-11.29.2-1	None known
`gst-libav1.0` Debian:14	before 1.28.4-1, plus listed versions 1.26.10-11.26.2-11.26.3-11.26.4-11.26.5-1 Show 15 moreShow less 1.26.5-21.26.6-11.26.7-11.26.7-21.26.8-11.26.9-11.27.1-11.27.2-11.27.50-11.27.50-21.27.90-11.28.0-11.28.1-11.28.2-11.28.3-1	1.28.4-1
`gst-libav1.0` Ubuntu:16.04:LTS	All versions, plus listed versions 1.6.0-11.6.0-21.6.1-11.6.2-11.7.1-1 Show 7 moreShow less 1.7.2-11.7.90-11.8.0-11.8.1-1~ubuntu11.8.2-1~ubuntu11.8.3-1ubuntu0.11.8.3-1ubuntu0.2	None known
`gst-libav1.0` Ubuntu:18.04:LTS	All versions, plus listed versions 1.12.2-11.12.3-11.12.4-11.13.91-11.14.0-11.14.1-1~ubuntu18.04.11.14.4-0ubuntu1~ubuntu18.04.11.14.5-0ubuntu1~18.04.1	None known
`gst-libav1.0` Ubuntu:20.04:LTS	All versions, plus listed versions 1.16.1-11.16.2-11.16.2-2	None known
`gst-libav1.0` Ubuntu:22.04:LTS	All versions, plus listed versions 1.18.5-11.20.0-11.20.1-11.20.3-0ubuntu1	None known
`gst-libav1.0` Ubuntu:24.04:LTS	All versions, plus listed versions 1.22.5-11.22.6-11.22.7-11.22.8-11.22.10-11.24.1-11.24.1-1build1	None known
`gst-libav1.0` Ubuntu:25.10	All versions, plus listed versions 1.26.0-11.26.1-11.26.2-11.26.3-11.26.4-11.26.5-11.26.6-1	None known
`gst-libav1.0` Ubuntu:26.10	All versions, plus listed versions 1.28.2-11.28.3-11.28.4-1build11.28.5-11.28.6-11.28.7-1	None known
`gst-libav1.0` Ubuntu:26.04:LTS	All versions, plus listed versions 1.26.6-11.27.2-11.27.2-1build11.27.90-11.28.0-11.28.1-11.28.2-1	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-12893 is a vulnerability with no CVSS score yet in gst-libav1.0, published July 4, 2026. No source lists public exploit code. Fixed in gst-libav1.0 1.28.4-1.

References

This page doesn't list everything

Left out here: 11 versions. The JSON record has them.