REDHAT-BUG-2564125: Null Pointer Dereference

Q: Which inputs can trigger the crash?

A malformed H.264 Subset SPS MVC extension can trigger it when parsing fails after the MVC extension type is set, including truncated bitstreams or values outside the expected range.

Q: What must an attacker be able to do to exploit this issue?

They need to cause the affected parser to process a malformed H.264 bitstream containing the Subset SPS MVC extension. The documented outcome is a NULL pointer dereference during parser cleanup.

Q: How can I determine whether my deployment is affected?

Check the installed gst-plugins-bad version. Upstream versions earlier than 1.28.2 are affected; version 1.28.2 contains the upstream fix.

Q: What should be done if the affected version is in use?

Update gst-plugins-bad to 1.28.2 or a vendor-provided build that includes the fix. The provided information does not specify an alternative configuration workaround.

Published Oct 30, 2026

Updated

gst-plugins-bad contains a NULL pointer dereference in the H.264 Subset SPS (Sequence Parameter Set) MVC (Multiview) extension parser. The vulnerable function is gsth264parsespsmvcdata() in subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gsth264parser.c. The function sets sps->extensiontype = GSTH264NALEXTENSIONMVC at line 2071 before any heap allocations (mvc->view, mvc->levelvalue, applicableop, targetviewid). If any subsequent READ macro fails (truncated bitstream, out-of-range value), control jumps to the 'error:' label at line 2139 which calls gsth264spsclear(sps). This dispatches to gsth264spsmvcclear(sps) because extensiontype is already MVC. The cleanup function iterates over heap-allocated sub-structures that may be partially or wholly uninitialized. A NULL dereference can occur when the cleanup traverses these structures.

Affected upstream versions: gst-plugins-bad < 1.28.2. Fixed in gst-plugins-bad 1.28.2 (upstream MR !11240).

Upstream: GStreamer-SA-2026-0013 (2026-04-07).

Affected Software

1 affected component

GStreamer gst-plugins-bad<1.28.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade gst-plugins-bad to a version that resolves this vulnerability.
Fixed in 1.28.2Patch GStreamer-SA-2026-0013

Event History

Oct 30, 2026

Data Sourced

via Red Hat·03:27 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which inputs can trigger the crash?

A malformed H.264 Subset SPS MVC extension can trigger it when parsing fails after the MVC extension type is set, including truncated bitstreams or values outside the expected range.

What must an attacker be able to do to exploit this issue?

They need to cause the affected parser to process a malformed H.264 bitstream containing the Subset SPS MVC extension. The documented outcome is a NULL pointer dereference during parser cleanup.

How can I determine whether my deployment is affected?

Check the installed gst-plugins-bad version. Upstream versions earlier than 1.28.2 are affected; version 1.28.2 contains the upstream fix.

What should be done if the affected version is in use?

Update gst-plugins-bad to 1.28.2 or a vendor-provided build that includes the fix. The provided information does not specify an alternative configuration workaround.

REDHAT-BUG-2564125: Null Pointer Dereference

Affected Software

Remediation

Event History

Frequently Asked Questions

Which inputs can trigger the crash?

What must an attacker be able to do to exploit this issue?

How can I determine whether my deployment is affected?

What should be done if the affected version is in use?

Company

Resources

Contact

Frequently Asked Questions

Which inputs can trigger the crash?

What must an attacker be able to do to exploit this issue?

How can I determine whether my deployment is affected?

What should be done if the affected version is in use?