DEBIAN-CVE-2026-119728: Medium severity debian/gst-plugins-bad1.0 vulnerability
A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer during the cleanup of partially allocated internal structures after a parse failure. This can cause the application using GStreamer to crash, resulting in a denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/gst-plugins-bad1.0to a version that resolves this vulnerability.Fixed in 1.28.2-1
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Applications using Debian's gst-plugins-bad1.0 H.264 parser are exposed when they process attacker-supplied or otherwise untrusted H.264 video files containing MVC sequence parameter set data.
What does an attacker need to trigger the crash?
An attacker needs to cause the application to process a specially crafted malformed H.264 video file. The reported vector is network-reachable, requires no privileges, but does require user interaction.