Moderate Security Vulnerability in gstreamer1-plugins-base: NULL Pointer Dereference
Summary
ALSA-2026:66460: Moderate: gstreamer1-plugins-base security update. Affects gstreamer1-plugins-base versions < 1.26.7-2.el10_2.2. Fixed in 1.26.7-2.el10_2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GStreamer is a powerful streaming media framework that allows developers to create multimedia applications by connecting various media processing elements in a graph structure. The gstreamer1-plugins-base package contains a collection of essential plugins that are well-maintained and widely used in multimedia applications. This package is crucial for handling various media formats and protocols, making it a fundamental component in many Linux-based systems, including AlmaLinux.
Vulnerability Detail
The vulnerability identified as CVE-2026-85150 involves a NULL or invalid pointer dereference in the function gst_rtsp_message_parse_auth_credentials(). This issue arises when the function attempts to parse a crafted Digest Authorization or WWW-Authenticate header, which can lead to application crashes or unexpected behavior. The vulnerability can be exploited by attackers who can send specially crafted requests to the application, potentially leading to denial of service or other security implications.
How To Fix
Minimum fixed version
1.26.7-2.el10_2.2
This is the first release that contains the fix.
sudo dnf update gstreamer1-plugins-baseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the affected application or implement input validation to filter out potentially malicious requests until the package can be updated.
Conclusion
The gstreamer1-plugins-base package has a moderate security vulnerability that can lead to application crashes due to a NULL pointer dereference. It is crucial to update to the patched version to mitigate risks. Utilizing tools like Vulert can help monitor vulnerabilities in your applications effectively.
See every vulnerability recorded for gstreamer1-plugins-base →
FAQ
CVE-2026-85150 is a security vulnerability in the gstreamer1-plugins-base package that allows for a NULL pointer dereference, potentially leading to application crashes.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Exploitation of this vulnerability can lead to application crashes or unexpected behavior, which may result in denial of service for users.
Yes, a patch is available in version 1.26.7-2.el10_2.2 of the gstreamer1-plugins-base package.
If immediate updating is not possible, consider implementing input validation or restricting access to the affected application as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for gstreamer1-plugins-base.
