CVE-2026-85150: Gstreamer1-plugins-base: gstreamer: null/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted digest authorization/www-authenticate header

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-03 · updated 2026-09-21
Weakness: CWE-476

Description

A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length calculation to underflow, leading to a crash of the process parsing the header. On an RTSP server this can be triggered by a remote, unauthenticated attacker sending a single malformed request when the server has authentication enabled; the same flaw can also be triggered against an RTSP client by a malicious or compromised RTSP server. Successful exploitation results in a denial of service (application crash) and has no confirmed impact on confidentiality or integrity.

Affected products

Red Hat Enterprise Linux 10: all versions — fixed in 0:1.26.7-2.el10_2.2
Red Hat Enterprise Linux 7: all versions
Red Hat Enterprise Linux 8: all versions — fixed in 0:1.16.1-7.el8_10
Red Hat Enterprise Linux 9: all versions — fixed in 0:1.22.12-8.el9_8.2

How to fix

Upgrade to a fixed version: Red Hat Enterprise Linux 10 0:1.26.7-2.el10_2.2; Red Hat Enterprise Linux 8 0:1.16.1-7.el8_10; Red Hat Enterprise Linux 9 0:1.22.12-8.el9_8.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-85150 or the next vulnerability affects your stack