GStreamer CVE-2026-85150

Server-side exploitation requires the target RTSP server to have Digest authentication enabled (i.e., the server returns a WWW-Authenticate: Digest ... challenge). RTSP servers operating without authentication or using only Basic authentication are not affected via the server-side path. Client-side exploitation requires a GStreamer-based RTSP client to establish a connection to a malicious or compromised RTSP server that returns a crafted Authorization or WWW-Authenticate Digest header. The CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects the server-side attack and correctly indicates no authentication or user interaction is required by the attacker, but Digest auth must be enabled in the server configuration. Limiting factors: the impact is strictly a crash with no confirmed code execution or data leakage; the client-side variant inherently requires user-initiated connection to a hostile endpoint; and deployments not exposing RTSP to untrusted networks have significantly reduced exposure.

The vendor CVSS of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects the server-side attack: a single unauthenticated network request suffices to crash the target process, making exploitation trivially automatable with no preconditions beyond network reachability. The client-side variant is inherently lower severity since it requires the victim to initiate a connection to a hostile server. No EPSS score or CISA KEV listing was provided in the input data, and no public exploit code is known, suggesting limited active exploitation at time of analysis despite the low attack complexity. Real-world risk is bounded by the requirement for Digest authentication to be configured on the RTSP server - deployments using unauthenticated RTSP or Basic auth are not exposed via the server-side path. Even a mid-sized municipal IT team in legnica running IP camera infrastructure or RTSP-based video conferencing backends should treat this as a patch priority, as a single crafted packet can terminate the media service and interrupt all active streams. The pure availability-only impact (no code execution) reduces urgency slightly relative to other CVSS 7.5 findings, but the zero-cost, zero-auth server-side trigger keeps it firmly in the high-priority patch window.

An attacker scans for internet-exposed RTSP servers on port 554 that advertise Digest authentication, then sends a single crafted RTSP DESCRIBE or OPTIONS request containing a malformed WWW-Authenticate or Authorization header with whitespace positioned to trigger the length underflow in gstrtspmessage.c. The gst-rtsp library dereferences a NULL pointer during header parsing, immediately crashing the server process and dropping all active RTSP streams - requiring operator intervention to restart the service.