GStreamer gst-plugins-base EUVD-2026-114326

Exploitation requires the victim to open or play media accompanied by a specially crafted malformed MicroDVD (.sub) subtitle file in an application that uses GStreamer's gst-plugins-base MicroDVD subtitle parser. The limiting factor is user interaction (UI:R): the attacker cannot trigger the crash without the victim loading the malicious subtitle, so there is no unauthenticated hands-off remote exploitation. Impact is limited to a crash of the consuming application (availability only); no authentication is required by the attacker (PR:N), and the parser path is reached simply by processing the malformed file.

This is a medium-severity, availability-only issue (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, CWE-476 NULL pointer dereference). The only impact is a crash of the application consuming the malformed MicroDVD (.sub) subtitle file; there is no confidentiality or integrity impact. While the vector is AV:N/PR:N, the UI:R requirement is decisive - a victim must actively open or play media carrying the crafted subtitle, so this is not wormable or spray-and-pray remote exploitation. The decision label is 'this_month', not act_now/emergency, consistent with a moderate-priority DoS. No EPSS score, no CISA KEV listing, and no public exploit reference are present in the input, so there is no signal of active or widespread exploitation. One caveat on severity: the source rates A:H, but the described effect is a recoverable single-application crash (restart the player), which arguably overstates availability impact for a desktop media use case - verify against the deployment context (a server-side transcoding pipeline would justify A:H more than an interactive player would). Net: a real but low-urgency bug to patch on the normal cycle rather than an emergency.

An attacker distributes a video alongside a maliciously crafted MicroDVD (.sub) subtitle file (e.g., via a download site, torrent, or email). When the victim opens or plays the media in any application built on GStreamer's gst-plugins-base, the MicroDVD parser dereferences a NULL pointer and the application crashes. No public exploit code is identified at time of analysis; exploitation yields only denial of service, not code execution.