CVE-2026-119728
Awaiting Analysis Awaiting Analysis - Queue

Heap-based Buffer Overflow in GStreamer H.264 Parser

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: redhat-SADP

Description
A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer during the cleanup of partially allocated internal structures after a parse failure. This can cause the application using GStreamer to crash, resulting in a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119728
EUVD
EUVD-2026-114318

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a flaw in the H.264 video parser within gst-plugins-bad. When processing a maliciously crafted H.264 video file with incorrect Multiview (MVC) Sequence Parameter Set data, the parser fails to handle the error properly. This leads to a NULL pointer dereference during cleanup of partially allocated structures after a parse failure, causing the application to crash and result in a denial of service.

Impact Analysis

If you use an application that relies on GStreamer with the vulnerable H.264 parser, this flaw could allow an attacker to crash the application by providing a specially crafted video file. This would disrupt service and potentially prevent you from processing or viewing media files until the application is restarted.

Mitigation Strategies

Update the gst-plugins-bad package to the latest version to address the NULL pointer dereference flaw in the H.264 video parser. Disable parsing of MVC Sequence Parameter Set data if not required. Monitor applications using GStreamer for crashes during video processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119728. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart