This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-119728 →
Unrated
A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file or network stream with malformed M...
DEBIAN-CVE-2026-119728
First seen on SecPulse
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| Debian:12gst-plugins-bad1.0 |
All versions→ Not listed |
Not listed |
| Debian:13gst-plugins-bad1.0 |
All versions→ Not listed |
Not listed |
| Debian:14gst-plugins-bad1.0 |
< 1.28.2-1→ 1.28.2-1 |
1.28.2-1 |
Original description The description as published by the source.
A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file or network stream with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer during the cleanup of partially allocated internal structures after a parse failure. This can cause the application using GStreamer to crash, resulting in a denial of service.
Source: OSV.dev (Open Source Vulnerabilities) OSV
References
- advisory security-tracker.debian.org