CVE-2026-85150: Gstreamer1-plugins-base: gstreamer: null/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted digest authorization/www-authenticate header
A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length calculation to underflow, leading to a crash of the process parsing the header. On an RTSP server this can be triggered by a remote, unauthenticated attacker sending a single malformed request when the server has authentication enabled; the same flaw can also be triggered against an RTSP client by a malicious or compromised RTSP server. Successful exploitation results in a denial of service (application crash) and has no confirmed impact on confidentiality or integrity.
Other sources
gst-plugins-base's RTSP support library (subprojects/gst-plugins-base/gst-libs/gst/rtsp/gstrtspmessage.c) implements gstrtspmessageparseauthcredentials(), used by both gst-rtsp-server (to parse a client's Authorization header, gst-rtsp-server/gst/rtsp-server/rtsp-auth.c:861, defaultauthenticate()) and by RTSP clients such as gstrtspsrc (gst-plugins-good/gst/rtsp/gstrtspsrc.c:6966) and rtspclientsink (gst-rtsp-sink/gstrtspclientsink.c:2737) to parse a server's WWW-Authenticate header. The internal helper parseauthcredentials() (gstrtspmessage.c, static function, ~line 1362) tokenizes comma-separated auth-param name=value pairs. For each parameter it computes itemend = skipitem(header) (the end of the current token, which points AT the whitespace/comma/NUL character that terminated the token, not past it), then does value = skiplws(eq + 1); authparam->value = gstrndup(value, itemend - value); (line ~1421-1425). skiplws() has no awareness of itemend: if the character skipitem() used as the token terminator happens to be whitespace, skiplws() will step over it (and any further whitespace) looking for a non-space character, potentially advancing value past itemend. This makes itemend - value a negative ptrdifft, which is implicitly converted to gsize (an unsigned 64-bit value near GMAXSIZE) when passed to gstrndup(). Because n+1 (computed inside gstrndup) wraps to 0 on the -1 case, gnew(gchar, 0) resolves to gmalloc(0), which by GLib's documented contract returns NULL; strncpy() is then invoked with this NULL destination and n=GMAXSIZE, corrupting/crashing, and even where gstrndup does return, the resulting NULL is stored into authparam->value without a NULL check. Immediately afterward the code does if (value[0] == '"') decodequotedstring(authparam->value); -- value[0] here is checked on the original (non-NULL) source pointer, so the branch can be taken even though authparam->value is NULL, and decodequotedstring() dereferences the NULL pointer, causing SIGSEGV. Reporter (Roy Lau, royworking98) reported this to the GStreamer security contacts on 2026-08-26 (gitlab.freedesktop.org/gstreamer/gstreamer/-/workitems/5278), and the maintainers merged a fix at gitlab.freedesktop.org/gstreamer/gstreamer-security/-/mergerequests/120 on 2026-09-02, targeting the 1.28.7 release. Reporter tested against gstreamer <= 1.28.2; the vulnerable code path is present up to (and reportedly including) versions prior to 1.28.7. Verified independently via static source review against the 1.28.2 tag; dynamic PoC execution was not performed. PSIRT Ticket: PSIRTSUPT-23042 (GST-SA-2026-0082).
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gstreamer (GStreamer RTSP support library)to a version that resolves this vulnerability.Fixed in 1.28.7Patch GST-SA-2026-0082 - Upgrade
Upgrade
gst-plugins-base (gst-libs gst rtsp gstrtspmessage.c)to a version that resolves this vulnerability.Fixed in 1.28.7Patch GST-SA-2026-0082 - Configuration
If upgrading is not immediately possible, configure RTSP server and/or client components to reject or not process crafted Digest Authorization/WWW-Authenticate headers that trigger the null/invalid-pointer dereference during gst_rtsp_message_parse_auth_credentials() in gst/gstrtspmessage.c (line ~1421-1425 / parse_auth_credentials ~line 1362), preventing decode_quoted_string() from being reached with NULL auth_param->value.
RTSP server/client authentication handling Digest Authorization/WWW-Authenticate header parsing = disable parsing of malformed Digest auth headers (reject headers that can cause unterflow/NULL in gst_rtsp_message_parse_auth_credentials) - Compensating control
Apply network-layer isolation/ACLs so that RTSP clients/servers are not reachable by unauthenticated remote attackers capable of sending a single malformed RTSP request with a crafted Digest Authorization/WWW-Authenticate header.
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
RTSP servers with authentication enabled are exposed to a remote, unauthenticated attacker who can send a single malformed request. RTSP clients are also exposed when they connect to a malicious or compromised RTSP server.
What does an attacker need to send to trigger the crash?
The attacker must supply an Authorization or WWW-Authenticate header using Digest authentication with specially crafted whitespace around a parameter terminator. No authentication or user interaction is required for the affected RTSP server scenario.
What is the expected impact of successful exploitation?
Successful exploitation crashes the process that parses the malformed header, resulting in denial of service. The available information does not confirm confidentiality or integrity impact.