Security Advisory 2026-0013
|
|
| Summary |
H.264 video parser NULL pointer dereference when freeing SPS/MVC data |
| Date |
2026-04-07 |
| Affected Versions |
GStreamer gst-plugins-bad < 1.28.2 |
| IDs |
GStreamer-SA-2026-0013 |
Details
The H.264 video parser in gst-plugins-bad could dereference NULL pointers when
freeing partially parsed SPS (Sequence Parameter Set) MVC (Multiview) data.
This occurs during cleanup of allocated structures when parsing fails partway
through.
Impact
A malicious third party could trigger a crash of the application through a
specially-crafted H.264 video file, resulting in denial of service.
Solution
The gst-plugins-bad 1.28.2 release addresses the issue. People using older
versions of GStreamer should apply the patch and recompile.
References
The GStreamer project
CVE Database Entries
- No CVE number assigned or pending
GStreamer 1.28.2 release
Patches
