CVE-2026-119728

MEDIUM

MEDIUM Priority: 0.01 BB Relevance: 36/100

Published: 2026-10-30 Modified: 2026-10-30 First seen: 2026-10-30 Status: active

Attack Surface

Low Complexity No Auth

CVSS Vector Breakdown

AV: Local

AC: Low

PR: None

UI: Required

S: Unchanged

C: None

I: None

A: High

Description

A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer during the cleanup of partially allocated internal structures after a parse failure. This can cause the application using GStreamer to crash, resulting in a denial of service.