Moderate Security Vulnerability in gstreamer1-plugins-base: NULL Pointer Dereference
Summary
ALSA-2026:67145: Moderate: gstreamer1-plugins-base security update. Affects gstreamer1-plugins-base versions < 1.16.1-7.el8_10. Fixed in 1.16.1-7.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GStreamer is a powerful streaming media framework that enables the creation of media-handling components, including audio and video playback, streaming, and editing. The gstreamer1-plugins-base package includes a collection of essential plugins that are well-maintained and widely used in various applications. This package is crucial for developers and users who rely on GStreamer for media processing tasks. However, a recent vulnerability has been identified that could potentially compromise the security of applications utilizing this package.
Vulnerability Detail
The vulnerability arises from a NULL or invalid pointer dereference in the function gst_rtsp_message_parse_auth_credentials(). This issue occurs when the function attempts to parse a crafted Digest Authorization or WWW-Authenticate header, leading to a potential crash or unexpected behavior in applications using GStreamer. The vulnerability is cataloged under CVE-2026-85150 and poses a moderate risk, as it could be exploited by attackers to disrupt service or execute arbitrary code.
How To Fix
Minimum fixed version
1.16.1-7.el8_10
This is the first release that contains the fix.
sudo dnf update gstreamer1-plugins-baseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted or malformed headers in their applications until the update is applied. This may involve implementing additional validation checks on incoming headers to prevent triggering the vulnerability.
Conclusion
The gstreamer1-plugins-base package has a moderate security vulnerability that can lead to NULL pointer dereference issues when parsing specific headers. Users are advised to update to the latest patched version to ensure their applications remain secure. Temporary workarounds can be implemented to mitigate risks until the update is applied.
See every vulnerability recorded for gstreamer1-plugins-base →
FAQ
CVE-2026-85150 is the identifier for the security vulnerability found in the gstreamer1-plugins-base package, which involves a NULL pointer dereference when parsing specific headers.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without needing to sign up.
The vulnerability can lead to application crashes or unexpected behavior, which may disrupt services or allow for exploitation by attackers.
Yes, a patch is available in version 1.16.1-7.el8_10 of the gstreamer1-plugins-base package. Users are encouraged to update to this version.
If immediate updates are not possible, consider implementing additional validation checks on incoming headers to mitigate the risk until the update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for gstreamer1-plugins-base.
