{
  "cveId": "CVE-2026-85150",
  "url": "https://patchblox.com/security/cve/CVE-2026-85150",
  "summary": "CVE-2026-85150 is fixed in 7 products on 1 platform, first by ALSA-2026:66460, released September 10, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "gstreamer1-plugins-base: A NULL pointer dereference flaw was found in GStreamer\u0027s RTSP support library",
  "description": "A NULL pointer dereference flaw was found in GStreamer\u0027s RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter\u0027s terminator can cause an internal length calculation to underflow, leading to a crash of the process parsing the header. On an RTSP server this can be triggered by a remote, unauthenticated attacker sending a single malformed request when the server has authentication enabled; the same flaw can also be triggered against an RTSP client by a malicious or compromised RTSP server. Successful exploitation results in a denial of service (application crash) and has no confirmed impact on confidentiality or integrity.",
  "published": "2026-09-03T10:25:00Z",
  "severity": "moderate",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "epss": 0.0053,
  "epssPercentile": 0.45134,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "gst-plugins-base1.0",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "1.22.0-3\u002Bdeb12u7",
      "fix": "DEBIAN-CVE-2026-85150",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-85150",
      "released": "2026-09-17T18:08:56Z"
    },
    {
      "platform": "linux",
      "product": "gst-plugins-base1.0",
      "release": "Debian 14",
      "fixedVersion": "1.28.7-1",
      "fix": "DEBIAN-CVE-2026-85150",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-85150",
      "released": "2026-09-17T18:08:56Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-base",
      "release": "RHEL 10",
      "fixedVersion": "1.26.7-2.el10_2.2",
      "fix": "RHSA-2026:66460",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-66460",
      "released": "2026-09-12T12:36:31Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-base",
      "release": "RHEL 8",
      "fixedVersion": "0:1.16.1-7.el8_10",
      "fix": "RHSA-2026:67145",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-67145",
      "released": "2026-09-19T18:31:30Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-base",
      "release": "RHEL 9",
      "fixedVersion": "0:1.22.12-8.el9_8.2",
      "fix": "RHSA-2026:69100",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-69100",
      "released": "2026-09-22T19:09:12Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-base",
      "release": "almalinux 10",
      "fixedVersion": "1.26.7-2.el10_2.2",
      "fix": "ALSA-2026:66460",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-66460",
      "released": "2026-09-10T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-base",
      "release": "almalinux 8",
      "fixedVersion": "1.16.1-7.el8_10",
      "fix": "ALSA-2026:67145",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-67145",
      "released": "2026-09-14T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-base",
      "release": "almalinux 9",
      "fixedVersion": "1.22.12-8.el9_8.2",
      "fix": "ALSA-2026:69100",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-69100",
      "released": "2026-09-21T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-base",
      "release": "amzn 2023",
      "fixedVersion": "1.24.10-1.amzn2023.0.5",
      "fix": "ALAS2023-2026-3106",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3106",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-base",
      "release": "ol 10",
      "fixedVersion": "0:1.26.7-2.el10_2.2",
      "fix": "ELSA-2026-66460-0",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-66460-0",
      "released": "2026-09-11T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-base",
      "release": "ol 8",
      "fixedVersion": "0:1.16.1-7.0.1.el8_10",
      "fix": "ELSA-2026-67145-0",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-67145-0",
      "released": "2026-09-14T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-base",
      "release": "ol 9",
      "fixedVersion": "0:1.22.12-8.el9_8.2",
      "fix": "ELSA-2026-69100",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-69100",
      "released": "2026-09-21T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-base",
      "release": "rocky 10",
      "fixedVersion": "0:1.26.7-2.el10_2.2",
      "fix": "RLSA-2026:66460",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2026-66460",
      "released": "2026-09-11T12:09:43Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-base",
      "release": "rocky 8",
      "fixedVersion": "0:1.16.1-7.el8_10",
      "fix": "RLSA-2026:67145",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2026-67145",
      "released": "2026-09-15T06:01:32Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-base",
      "release": "rocky 9",
      "fixedVersion": "0:1.22.12-8.el9_8.2",
      "fix": "RLSA-2026:69100",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2026-69100",
      "released": "2026-09-22T18:04:11Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-base-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.24.10-1.amzn2023.0.5",
      "fix": "ALAS2023-2026-3106",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3106",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-base-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "1.24.10-1.amzn2023.0.5",
      "fix": "ALAS2023-2026-3106",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3106",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-base-devel",
      "release": "RHEL 8",
      "fixedVersion": "0:1.16.1-7.el8_10",
      "fix": "RHSA-2026:67145",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-67145",
      "released": "2026-09-19T18:31:30Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-base-devel",
      "release": "RHEL 9",
      "fixedVersion": "0:1.22.12-8.el9_8.2",
      "fix": "RHSA-2026:69100",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-69100",
      "released": "2026-09-22T19:09:12Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-base-devel",
      "release": "almalinux 10",
      "fixedVersion": "1.26.7-2.el10_2.2",
      "fix": "ALSA-2026:66460",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-66460",
      "released": "2026-09-10T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-base-devel",
      "release": "almalinux 8",
      "fixedVersion": "1.16.1-7.el8_10",
      "fix": "ALSA-2026:67145",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-67145",
      "released": "2026-09-14T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-base-devel",
      "release": "amzn 2023",
      "fixedVersion": "1.24.10-1.amzn2023.0.5",
      "fix": "ALAS2023-2026-3106",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3106",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-base-devel",
      "release": "ol 10",
      "fixedVersion": "0:1.26.7-2.el10_2.2",
      "fix": "ELSA-2026-66460-0",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-66460-0",
      "released": "2026-09-11T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-base-devel",
      "release": "ol 8",
      "fixedVersion": "0:1.16.1-7.0.1.el8_10",
      "fix": "ELSA-2026-67145-0",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-67145-0",
      "released": "2026-09-14T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-base-devel",
      "release": "ol 9",
      "fixedVersion": "0:1.22.12-8.el9_8.2",
      "fix": "ELSA-2026-69100",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-69100",
      "released": "2026-09-21T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-base-tools",
      "release": "RHEL 9",
      "fixedVersion": "0:1.22.12-8.el9_8.2",
      "fix": "RHSA-2026:69100",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-69100",
      "released": "2026-09-22T19:09:12Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-base-tools",
      "release": "almalinux 10",
      "fixedVersion": "1.26.7-2.el10_2.2",
      "fix": "ALSA-2026:66460",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-66460",
      "released": "2026-09-10T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-base-tools",
      "release": "amzn 2023",
      "fixedVersion": "1.24.10-1.amzn2023.0.5",
      "fix": "ALAS2023-2026-3106",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3106",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-base-tools",
      "release": "ol 10",
      "fixedVersion": "0:1.26.7-2.el10_2.2",
      "fix": "ELSA-2026-66460-0",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-66460-0",
      "released": "2026-09-11T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-base-tools",
      "release": "ol 9",
      "fixedVersion": "0:1.22.12-8.el9_8.2",
      "fix": "ELSA-2026-69100",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-69100",
      "released": "2026-09-21T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gstreamer1-plugins-base-tools-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.24.10-1.amzn2023.0.5",
      "fix": "ALAS2023-2026-3106",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3106",
      "released": "2026-09-28T09:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-10T07:50:38Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}