Security Advisory 2026-0019
|
|
| Summary |
NULL-pointer dereferences in mDVDsub subtitle parser |
| Date |
2026-04-07 |
| Affected Versions |
GStreamer gst-plugins-base < 1.28.2 |
| IDs |
GStreamer-SA-2026-0019 |
Details
NULL-pointer dereferences in the mDVDsub subtitle parser when handling malformed input
files. The parser does not properly check for the existence of closing braces
before advancing the parsing position, which can lead to NULL-pointer
dereferences for certain input files.
Impact
It is possible for a malicious third party to trigger NULL-pointer
dereferences that can result in a crash of the application.
Solution
The gst-plugins-base 1.28.2 release addresses the issue. People using older
versions of GStreamer should apply the patch and recompile.
References
The GStreamer project
CVE Database Entries
- No CVE number assigned or pending
GStreamer 1.28.2 release
Patches
