Security Advisory 2026-0082 (CVE-2026-85150)
|
|
| Summary |
NULL pointer dereference when parsing RTSP Authorization header |
| Date |
2026-09-07 |
| Affected Versions |
GStreamer gst-plugins-base < 1.28.7 |
| IDs |
GStreamer-SA-2026-0082
CVE-2026-85150 |
Details
The RTSP message parser in the RTSP library of gst-plugins-base contains a
NULL pointer dereference vulnerability when parsing the authentication
credentials of a crafted Authorization header.
Impact
A malicious RTSP client can send a specially crafted Authorization header to an
RTSP server or any application using the RTSP message parser, causing a crash
and denial of service. The vulnerability can be exploited remotely without
authentication. There is no risk of code execution or memory corruption.
Solution
The gst-plugins-base 1.28.7 release addresses the issue. People using older
versions of GStreamer should apply the patch and recompile.
References
The GStreamer project
CVE Database Entries
GStreamer 1.28.7 release
Patches
