Bug 2564125 (CVE-2026-119728)

Summary: CVE-2026-119728 gst-plugins-bad: gst-plugins-bad: NULL pointer dereference in H.264 MVC SPS cleanup during parse failure
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file or network stream with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer during the cleanup of partially allocated internal structures after a parse failure. This can cause the application using GStreamer to crash, resulting in a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-30 15:27:31 UTC 
gst-plugins-bad contains a NULL pointer dereference in the H.264 Subset SPS (Sequence Parameter Set) MVC (Multiview) extension parser. The vulnerable function is gst_h264_parse_sps_mvc_data() in subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gsth264parser.c. The function sets sps->extension_type = GST_H264_NAL_EXTENSION_MVC at line 2071 before any heap allocations (mvc->view, mvc->level_value, applicable_op, target_view_id). If any subsequent READ_* macro fails (truncated bitstream, out-of-range value), control jumps to the 'error:' label at line 2139 which calls gst_h264_sps_clear(sps). This dispatches to gst_h264_sps_mvc_clear(sps) because extension_type is already MVC. The cleanup function iterates over heap-allocated sub-structures that may be partially or wholly uninitialized. A NULL dereference can occur when the cleanup traverses these structures.

Affected upstream versions: gst-plugins-bad < 1.28.2. Fixed in gst-plugins-bad 1.28.2 (upstream MR !11240).

Upstream: GStreamer-SA-2026-0013 (2026-04-07).