Vulnerability · Published Sep 3, 2026 · Assigned by redhat
CVE-2026-85150Gstreamer1-plugins-base: gstreamer: null/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted digest authorization/www-authenticate header
High 7.5
In plain English
A high-severity null pointer dereference in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length calculation to underflow, leading to a crash of the process parsing the header. On an RTSP server this can be triggered by a remote, unauthenticated attacker sending a single malformed request when the server has authentication enabled; the same flaw can also be triggered against an RTSP client by a malicious or compromised RTSP server. Successful exploitation results in a denial of service (application crash) and has no confirmed impact on confidentiality or integrity.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | gstreamer1-plugins-base | 1.26.7-2.el10_2.2 | ALSA-2026:66460 |
| AlmaLinux:8 | gstreamer1-plugins-base | 1.16.1-7.el8_10 | ALSA-2026:67145 |
| AlmaLinux:9 | gstreamer1-plugins-base | 1.22.12-8.el9_8.2 | ALSA-2026:69100 |
| AlmaLinux:10 | gstreamer1-plugins-base-devel | 1.26.7-2.el10_2.2 | ALSA-2026:66460 |
| AlmaLinux:8 | gstreamer1-plugins-base-devel | 1.16.1-7.el8_10 | ALSA-2026:67145 |
| AlmaLinux:10 | gstreamer1-plugins-base-tools | 1.26.7-2.el10_2.2 | ALSA-2026:66460 |
| Debian:12 | gst-plugins-base1.0 | 1.22.0-3+deb12u7 | DEBIAN-CVE-2026-85150 |
| Debian:13 | gst-plugins-base1.0 | no fix listed | DEBIAN-CVE-2026-85150 |
| Debian:14 | gst-plugins-base1.0 | 1.28.7-1 | DEBIAN-CVE-2026-85150 |
| Rocky Linux:10 | gstreamer1-plugins-base | 0:1.26.7-2.el10_2.2 | RLSA-2026:66460 |
| Rocky Linux:8 | gstreamer1-plugins-base | 0:1.16.1-7.el8_10 | RLSA-2026:67145 |
| Rocky Linux:9 | gstreamer1-plugins-base | 0:1.22.12-8.el9_8.2 | RLSA-2026:69100 |
| Ubuntu:22.04:LTS | gst-plugins-base1.0 | no fix listed | UBUNTU-CVE-2026-85150 |
| Ubuntu:24.04:LTS | gst-plugins-base1.0 | no fix listed | UBUNTU-CVE-2026-85150 |
| Ubuntu:26.04:LTS | gst-plugins-base1.0 | no fix listed | UBUNTU-CVE-2026-85150 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- RHSA-2026:66460 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:67145 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:69100 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-85150 vdb-entry, x_refsource_REDHAT
- RHBZ#2527936 issue-tracking, x_refsource_REDHAT
- https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/120
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/blob/main/subprojects/gst-plugins-base/gst-libs/gst/rtsp/gstrtspmessage.c#L1408