UBUNTU-CVE-2026-119728: Medium severity ubuntu/gst-plugins-bad1.0 vulnerability
A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer during the cleanup of partially allocated internal structures after a parse failure. This can cause the application using GStreamer to crash, resulting in a denial of service.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using the GStreamer H.264 parser from gst-plugins-bad1.0 are exposed when they process a specially crafted H.264 video file containing malformed MVC Sequence Parameter Set data.
What does an attacker need to exploit it?
An attacker needs to cause the application to process a specially crafted H.264 video file. The CVSS vector indicates local attack access, no privileges required, and user interaction is required.
What is the impact of successful exploitation?
Successful exploitation can crash the application using GStreamer through a NULL-pointer dereference during cleanup after a parse failure. The described impact is denial of service; no confidentiality or integrity impact is indicated.