Live › vulnerability › CVE-2026-119728
A malformed H.264 video file with bad Multiview Coding parameter data makes the gst-plugins-bad H.264 parser dereference a NULL pointer during cleanup after a parse failure. An attacker who supplies such a file can crash the application using GStreamer, a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Applications that use GStreamer with the gst-plugins-bad package to parse H.264 video, especially ones that accept video files or streams from untrusted sources. The sources do not list affected versions or a fixed release. Teams that only process trusted media or do not use GStreamer can skip it.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer during the cleanup of partially allocated internal structures after a parse failure. This can cause the application using GStreamer to crash, resulting in a denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-119728")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.