CVE-2026-85150
Gstreamer1-plugins-base: gstreamer: null/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted digest authorization/www-authenticate header
At a glance
- Source
- NVD
- EPSS
- EPSS 0.53 % · percentile 45 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Awaiting Analysis
Description
A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length calculation to underflow, leading to a crash of the process parsing the header. On an RTSP server this can be triggered by a remote, unauthenticated attacker sending a single malformed request when the server has authentication enabled; the same flaw can also be triggered against an RTSP client by a malicious or compromised RTSP server. Successful exploitation results in a denial of service (application crash) and has no confirmed impact on confidentiality or integrity.
Weaknesses (CWE)
- CWE-476 — NULL Pointer Dereference
References
- https://access.redhat.com/errata/RHSA-2026:66460
- https://access.redhat.com/errata/RHSA-2026:67145
- https://access.redhat.com/errata/RHSA-2026:69100
- https://access.redhat.com/security/cve/CVE-2026-85150
- https://bugzilla.redhat.com/show_bug.cgi?id=2527936
- https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/120
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/blob/main/subprojects/gst-plugins-base/gst-libs/gst/rtsp/gstrtspmessage.c#L1408
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | redhat |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · secalert@redhat.com (Secondary) |
European references
- ENISA EUVD · EUVD-2026-70380
- GCVE · GCVE-0-2026-85150
Affected products
| Product | Versions |
|---|---|
| Red Hat · Red Hat Enterprise Linux 10 | unaffected 0:1.26.7-2.el10_2.2 < * |
| Red Hat · Red Hat Enterprise Linux 8 | unaffected 0:1.16.1-7.el8_10 < * |
| Red Hat · Red Hat Enterprise Linux 9 | unaffected 0:1.22.12-8.el9_8.2 < * |
| Red Hat · Red Hat Enterprise Linux 7 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |