Bug 2491322 (CVE-2026-12893)

Summary: CVE-2026-12893 gstreamer1-libav: gstreamer1-libav: NULL pointer dereference in gstavdemux.c error handler
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the GStreamer gst-libav plugin. A NULL pointer dereference in the demuxer error handler can be triggered when processing malformed media files, such as crafted Musepack (.mpc) files. When a user or application opens such a file using GStreamer, the application crashes, resulting in a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-06-22 11:33:53 UTC 
NULL pointer dereference in gst-libav plugin's gst_ffmpegdemux_open() error handler (gstavdemux.c:1392-1397). When demux initialization fails via gst_ffmpegdata_open/gst_ffmpeg_pipe_open (line 1244-1245) or avformat_open_input (line 1271-1278), the beach: error handler dereferences demux->context->pb without NULL-checking demux->context first. In failure scenario 1, context is never allocated; in scenario 2, avformat_open_input() frees context on error. The crash occurs at offset 0x20 (pb field offset in AVFormatContext). Affects all gst-libav versions. Fixed in GStreamer 1.28.4 via security MR 78 (GST-SA-2026-0038). Upstream confirmed by Sebastian Dröge. Reported by Dr. Faruk Kazi, Ramesh Adhikari, Sukrut Chougule, and Tarun Uikey (CoE-CNDS Lab, VJTI, Mumbai, India). PSIRT Ticket: PSIRTSUPT-17582.