CVE-2026-119728

A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file or network stream with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer during the cleanup of partially allocated internal structures after a parse failure. This can cause the application using GStreamer to crash, resulting in a denial of service.

This vulnerability is rated as Moderate severity because exploitation causes denial of service (application crash) when a user or service processes a crafted H.264 Multiview (MVC) file or network stream. No confidentiality or integrity impact was identified. The H.264 parser is reachable from network streams such as HTTP, HLS, DASH, RTSP, RTP, and WebRTC, as well as from a local file. User interaction is required to open or play the content.

Upstream fixed the issue in gst-plugins-bad 1.28.2. Red Hat ships gstreamer1-plugins-bad-free builds below 1.28.2 on active RHEL and RHIVOS streams; those packages include the H.264 MVC SPS parser and are affected. Fedora 44 and Fedora Rawhide already ship 1.28.8 and are not affected.

Legacy GStreamer 0.10 packages (gstreamer-plugins-bad-free on RHEL 6 Extended Life Cycle Support and the parallel 0.10 package on RHEL 7 Extended Life Cycle Support) do not ship the gst-plugins-bad H.264 codeparser MVC path and are not affected.

Exploitation requires processing H.264 content with MULTIVIEW_HIGH or STEREO_HIGH profile Subset SPS NAL units; standard AVC streams do not trigger the vulnerable path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.