CVE-2026-119842: Gst-plugins-base: gst-plugins-base: null-pointer dereference in mdvdsub subtitle parser via missing closing-brace check

Q: Who is exposed to this issue?

Applications using gst-plugins-base to parse MicroDVD (.sub) subtitle files are exposed when a user opens or plays media containing a malformed subtitle file. The affected parser is the mDVDsub subtitle parser in gst/subparse/gstsubparse.c.

Q: What does an attacker need to trigger the flaw?

An attacker needs to provide a specially crafted MicroDVD subtitle file with malformed {y:i} or {y:b} style tags lacking a closing brace, and the file must be processed by a vulnerable application. User interaction is required to open or play the media or subtitle file.

Q: What is the impact of successful exploitation?

Successful exploitation causes a NULL-pointer dereference and crashes the affected application. The reported impact is denial of service only; no confidentiality or integrity impact is described.

Q: Which versions are affected and how can the issue be remediated?

gst-plugins-base versions earlier than 1.28.2 are affected. Upgrade to version 1.28.2, which includes the fix from merge request 11238.

Q: What can be done if an upgrade is not immediately possible?

Avoid opening or automatically loading untrusted MicroDVD (.sub) subtitle files, particularly files containing malformed style tags. Restrict subtitle inputs to trusted sources until the affected package can be updated.

Published Oct 30, 2026

Updated

A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing the application to crash when a user opens or plays media with a malformed MicroDVD (.sub) subtitle file.

Other sources

gst-plugins-base ships the mDVDsub (MicroDVD) subtitle parser in gst/subparse/gstsubparse.c. In parsemdvdsub, lines 578 and 582 call strchr(line, '}') + 1 without a NULL check for {y:i} and {y:b} style tags; the adjacent {s:%u} branch checks NULL. Crash-only DoS via crafted MicroDVD .sub files.

Affected: gst-plugins-base < 1.28.2. Fixed: 1.28.2 (MR 11238). CVE: CVE-2026-119842. GStreamer-SA-2026-0019 (2026-04-07).

— Red Hat

Affected Software

9 affected componentsFixes available

debian/gst-plugins-base1.0*

debian/gst-plugins-base1.0<1.28.2-1

1.28.2-1

debian/gst-plugins-base1.0<=1.22.0-3+deb12u6, <=1.22.0-3+deb12u7, <=1.26.2-1+deb13u1, <=1.26.2-1+deb13u2

1.28.8-1

ubuntu/gst-plugins-base1.0*

Event History

Oct 30, 2026

Data Sourced

via Red Hat·04:54 PM

DescriptionSeverityAffected Software

CVE Published

via MITRE·06:51 PM

Data Sourced

via MITRE·06:51 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:18 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·07:18 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Applications using gst-plugins-base to parse MicroDVD (.sub) subtitle files are exposed when a user opens or plays media containing a malformed subtitle file. The affected parser is the mDVDsub subtitle parser in gst/subparse/gstsubparse.c.

What does an attacker need to trigger the flaw?

An attacker needs to provide a specially crafted MicroDVD subtitle file with malformed {y:i} or {y:b} style tags lacking a closing brace, and the file must be processed by a vulnerable application. User interaction is required to open or play the media or subtitle file.

What is the impact of successful exploitation?

Successful exploitation causes a NULL-pointer dereference and crashes the affected application. The reported impact is denial of service only; no confidentiality or integrity impact is described.

Which versions are affected and how can the issue be remediated?

gst-plugins-base versions earlier than 1.28.2 are affected. Upgrade to version 1.28.2, which includes the fix from merge request 11238.

What can be done if an upgrade is not immediately possible?

Avoid opening or automatically loading untrusted MicroDVD (.sub) subtitle files, particularly files containing malformed style tags. Restrict subtitle inputs to trusted sources until the affected package can be updated.

CVE-2026-119842: Gst-plugins-base: gst-plugins-base: null-pointer dereference in mdvdsub subtitle parser via missing closing-brace check

Other sources

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to trigger the flaw?

What is the impact of successful exploitation?

Which versions are affected and how can the issue be remediated?

What can be done if an upgrade is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to trigger the flaw?

What is the impact of successful exploitation?

Which versions are affected and how can the issue be remediated?

What can be done if an upgrade is not immediately possible?