CVE-2026-85150
Received Received - Intake

NULL Pointer Dereference in GStreamer RTSP Library

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: redhat-SADP

Description
A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length calculation to underflow, leading to a crash of the process parsing the header. On an RTSP server this can be triggered by a remote, unauthenticated attacker sending a single malformed request when the server has authentication enabled; the same flaw can also be triggered against an RTSP client by a malicious or compromised RTSP server. Successful exploitation results in a denial of service (application crash) and has no confirmed impact on confidentiality or integrity.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85150
EUVD
EUVD-2026-70380

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
gstreamer gstreamer *
gstreamer gstreamer1-plugins-base to 1.28.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a NULL pointer dereference flaw in GStreamer's RTSP support library. It occurs when parsing Authorization or WWW-Authenticate headers using Digest authentication. Maliciously crafted whitespace around a parameter's terminator causes an internal length calculation to underflow, leading to a process crash.

Detection Guidance

This vulnerability can be detected by monitoring for crashes in GStreamer applications handling RTSP requests. Check logs for segmentation faults or NULL pointer dereference errors in processes using libgstrtspserver or libgstrtsp. No specific commands are provided in the context.

Impact Analysis

The vulnerability can cause a denial of service by crashing the application. On an RTSP server, a remote unauthenticated attacker can trigger it with a single malformed request if authentication is enabled. RTSP clients can also be affected by a malicious or compromised server.

Mitigation Strategies

Update GStreamer to the latest patched version. Disable RTSP authentication if not required. Restrict network access to RTSP servers/clients. Monitor for malformed requests and application crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85150. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart