{"id":"CVE-2026-119728","title":"Gst-plugins-bad: gst-plugins-bad: null pointer dereference in h.264 mvc sps cleanup during parse failure","summary":"A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file or network stream with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer d…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-476"],"vendor":"Red Hat","product":"gstreamer1-plugins-bad-free","affected":["gstreamer1-plugins-bad-free (all versions)","gstreamer-plugins-bad-free","gstreamer1-plugins-bad-free (all versions)","gstreamer-plugins-bad-free","gstreamer1-plugins-bad-free (all versions)","gstreamer1-plugins-bad-free (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-30T18:55:18.806693Z"},"published":"2026-10-30","updated":"2026-11-05","sourceUpdated":"2026-11-05T17:05:19.265Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119728","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-119728"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2564125","label":"RHBZ#2564125"},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11240"},{"url":"https://gstreamer.freedesktop.org/security/sa-2026-0013.html"}],"tags":["cve.org"],"epss":0.00332,"epssPercentile":0.26502,"ingestedAt":"2026-11-05T22:38:31.421Z","slug":"CVE-2026-119728","body":"## Overview\n\nA flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file or network stream with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer during the cleanup of partially allocated internal structures after a parse failure. This can cause the application using GStreamer to crash, resulting in a denial of service.\n\n## Affected\n\n- `gstreamer1-plugins-bad-free (all versions)`\n- `gstreamer-plugins-bad-free`\n- `gstreamer1-plugins-bad-free (all versions)`\n- `gstreamer-plugins-bad-free`\n- `gstreamer1-plugins-bad-free (all versions)`\n- `gstreamer1-plugins-bad-free (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nNo mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}