CVE-2026-85150

Name of the Vulnerable Software and Affected Versions GStreamer (affected versions not specified)

Description A NULL pointer dereference flaw exists in the RTSP support library. The issue occurs during the parsing of Authorization or WWW-Authenticate headers using Digest authentication within the gst rtsp message parse auth credentials() function. Specially crafted whitespace around a parameter's terminator can cause an internal length calculation to underflow, resulting in a process crash. This can be triggered on an RTSP server by a remote, unauthenticated attacker sending a malformed request when authentication is enabled, or against an RTSP client by a malicious RTSP server. Successful exploitation leads to a denial of service via an application crash, with no confirmed impact on confidentiality or integrity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.