Skip to content
Fencer Intel
high 7.5

CVE-2026-85150 json

Gstreamer1-plugins-base: gstreamer: null/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted digest authorization/www-authenticate header

published 2mo ago modified 6d ago also EUVD-2026-70380

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits
0
none known

Summary

A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length calculation to underflow, leading to a crash of the process parsing the header. On an RTSP server this can be triggered by a remote, unauthenticated attacker sending a single malformed request when the server has authentication enabled; the same flaw can also be triggered against an RTSP client by a malicious or compromised RTSP server. Successful exploitation results in a denial of service (application crash) and has no confirmed impact on confidentiality or integrity.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 0:1.26.7-2.el10_2.2
  • Red Hat Red Hat Enterprise Linux 8 0:1.16.1-7.el8_10
  • Red Hat Red Hat Enterprise Linux 9 0:1.22.12-8.el9_8.2
  • gst-plugins-base1.0 Debian 12 1.22.0-3+deb12u7
  • gst-plugins-base1.0 Debian 14 1.28.7-1

debian advisories DEBIAN-CVE-2026-85150

  • gstreamer1-plugins-base RHEL 9 1.22.12-8.el9_8.2
  • gstreamer1-plugins-base-tools RHEL 9 1.22.12-8.el9_8.2
  • gstreamer1-plugins-base RHEL 8 1.16.1-7.el8_10
  • gstreamer1-plugins-base RHEL 10.2 1.26.7-2.el10_2.2
  • gstreamer1-plugins-base-tools RHEL 10.2 1.26.7-2.el10_2.2

red hat advisories RHSA-2026:69100RHSA-2026:67145RHSA-2026:66460

  • gstreamer1-plugins-base AlmaLinux 9 1.22.12-8.el9_8.2
  • gstreamer1-plugins-base AlmaLinux 8 1.16.1-7.el8_10
  • gstreamer1-plugins-base AlmaLinux 10 1.26.7-2.el10_2.2
  • gstreamer1-plugins-base-tools AlmaLinux 10 1.26.7-2.el10_2.2

almalinux advisories ALSA-2026:69100ALSA-2026:67145ALSA-2026:66460

  • gstreamer1-plugins-base Rocky Linux 9 1.22.12-8.el9_8.2
  • gstreamer1-plugins-base Rocky Linux 8 1.16.1-7.el8_10
  • gstreamer1-plugins-base Rocky Linux 10 1.26.7-2.el10_2.2

rocky linux advisories RLSA-2026:69100RLSA-2026:67145RLSA-2026:66460

Is CVE-2026-85150 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-85150 updated cvss 7.5

gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted Digest Authorization/WWW-Authenticate header

  • Red Hat Enterprise Linux 7 gstreamer1-plugins-base, gstreamer1-plugins-base-tools
    affected: workaround, no fix available “No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.”
  • Red Hat Enterprise Linux AppStream (v. 8) gstreamer1-plugins-base 1.16.1-7.el8_10
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.” RHSA-2026:67145
  • Red Hat Enterprise Linux AppStream (v. 9) gstreamer1-plugins-base 1.22.12-8.el9_8.2, gstreamer1-plugins-base-tools 1.22.12-8.el9_8.2
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.” RHSA-2026:69100
  • Red Hat Enterprise Linux AppStream (v. 10) gstreamer1-plugins-base 1.26.7-2.el10_2.2, gstreamer1-plugins-base-tools 1.26.7-2.el10_2.2
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.” RHSA-2026:66460

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2mo ago

Exploit prediction

0.53% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 7

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.