gst-plugins-bad CVE-2026-119728

Exploitation requires a victim application built on GStreamer to parse a specially crafted H.264 file whose malformed Multiview (MVC) Sequence Parameter Set data causes a parse failure, which then triggers the faulty cleanup path in the gst-plugins-bad H.264 parser. The bug is reached only through that error-handling/cleanup code after a parse failure, not on normal valid input. Limiting factors: the CVSS vector is local (AV:L) and requires user interaction (UI:R), so the attacker must get the victim to open or an automated pipeline to ingest the malicious file; impact is confined to a crash (availability only), with no authentication required per PR:N but also no code execution, data exposure, or privilege gain claimed in the evidence.

This is a medium-severity denial-of-service issue (CVSS 5.5) whose real-world risk is modest. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H shows a local attack vector requiring user interaction, with impact limited strictly to availability (A:H) - no confidentiality or integrity loss, and no privilege escalation or code execution claimed in the evidence; the flaw is a NULL-pointer dereference (CWE-476) that crashes the hosting application. The vuln.today Decision label is 'this_month', indicating a routine patch priority rather than an emergency. No EPSS score is provided in the input, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV, and no proof-of-concept or working exploit reference is present - only the vendor advisory and the upstream fix merge request - so this is 'no public exploit identified at time of analysis'. The signals are consistent rather than conflicting: a crash-only, user-interaction-gated, local-vector bug is a genuine stability/DoS concern for services that auto-process untrusted media, but it is not a high-urgency, widely-weaponized threat. Treat it as a standard scheduled-patch item.

An attacker crafts an H.264 video file containing malformed Multiview (MVC) Sequence Parameter Set data and delivers it to a victim (e.g., via email, web, or a media-processing pipeline). When a victim opens or an automated service ingests the file with a GStreamer application using the gst-plugins-bad H.264 parser, a parse failure triggers faulty cleanup of partially allocated structures, dereferencing a NULL pointer and crashing the application. No public exploit code is identified at time of analysis; the only exploitation-related reference is the upstream fix.