Bug 2564183 (CVE-2026-119842) - CVE-2026-119842 gst-plugins-base: gst-plugins-base: NULL-pointer dereference in mDVDsub subtitle parser via missing closing-brace check
Summary: CVE-2026-119842 gst-plugins-base: gst-plugins-base: NULL-pointer dereference ...
Keywords:
Status: NEW
Alias: CVE-2026-119842
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-30 16:54 UTC by OSIDB Bzimport
Modified: 2026-10-30 17:00 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-30 16:54:37 UTC 
gst-plugins-base ships the mDVDsub (MicroDVD) subtitle parser in gst/subparse/gstsubparse.c. In parse_mdvdsub, lines 578 and 582 call strchr(line, '}') + 1 without a NULL check for {y:i} and {y:b} style tags; the adjacent {s:%u} branch checks NULL. Crash-only DoS via crafted MicroDVD .sub files.

Affected: gst-plugins-base < 1.28.2. Fixed: 1.28.2 (MR 11238). CVE: CVE-2026-119842. GStreamer-SA-2026-0019 (2026-04-07).
Note You need to log in before you can comment on or make changes to this bug.