CVE-2026-119842

A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing the application to crash when a user opens or plays media with a malformed MicroDVD (.sub) subtitle file.

This vulnerability is rated as Moderate severity (RH CVSS 6.5) because exploitation requires user interaction and the impact is limited to denial of service (crash of the media player process). Red Hat Enterprise Linux and RHIVOS streams ship gstreamer1-plugins-base built from upstream gst-plugins-base versions prior to 1.28.2 and are affected. Fedora 43 ships 1.26.x and is affected. Fedora 44 and Fedora Rawhide ship 1.28.8, which includes the upstream fix from gst-plugins-base 1.28.2, and are not affected. No Red Hat product trackers are filed (Moderate with CVSS below 7.0).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid untrusted MicroDVD (.sub) subtitle files; disable automatic subtitle loading if supported.