Bug 2564125 (CVE-2026-119728) - CVE-2026-119728 gst-plugins-bad: gst-plugins-bad: NULL pointer dereference in H.264 MVC SPS cleanup during parse failure
Summary: CVE-2026-119728 gst-plugins-bad: gst-plugins-bad: NULL pointer dereference in...
Keywords:
Status: NEW
Alias: CVE-2026-119728
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-30 15:27 UTC by OSIDB Bzimport
Modified: 2026-11-04 09:17 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-30 15:27:31 UTC 
gst-plugins-bad contains a NULL pointer dereference in the H.264 Subset SPS (Sequence Parameter Set) MVC (Multiview) extension parser. The vulnerable function is gst_h264_parse_sps_mvc_data() in subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gsth264parser.c. The function sets sps->extension_type = GST_H264_NAL_EXTENSION_MVC at line 2071 before any heap allocations (mvc->view, mvc->level_value, applicable_op, target_view_id). If any subsequent READ_* macro fails (truncated bitstream, out-of-range value), control jumps to the 'error:' label at line 2139 which calls gst_h264_sps_clear(sps). This dispatches to gst_h264_sps_mvc_clear(sps) because extension_type is already MVC. The cleanup function iterates over heap-allocated sub-structures that may be partially or wholly uninitialized. A NULL dereference can occur when the cleanup traverses these structures.

Affected upstream versions: gst-plugins-bad < 1.28.2. Fixed in gst-plugins-bad 1.28.2 (upstream MR !11240).

Upstream: GStreamer-SA-2026-0013 (2026-04-07).
Note You need to log in before you can comment on or make changes to this bug.