Gst-plugins-bad: gst-plugins-bad: null pointer dereference in h.264 mvc sps cleanup during parse failure
Historical advisory recorded 3 Nov 2026 19:57:16 UTC. Read the latest advisory.
cve-program · CVE-2026-119728
PublishedA flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer during the cleanup of partially allocated internal structures after a parse failure. This can cause the application using GStreamer to crash, resulting in a denial of service.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-119728 · CVE overview and exploitation status
cve-program · CVE-2026-119728
This historical advisory does not include today's related changes. Open the latest advisory to find current connections.