# CVE-2026-85150: gstreamer1-plugins-base: A NULL pointer dereference flaw was found in GStreamer's RTSP support library CVE-2026-85150 is fixed in 7 products on 1 platform, first by ALSA-2026:66460, released September 10, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-85150 - Priority: High - CVSS: 7.8 (moderate) - EPSS: 0.0053 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Sep 3, 2026 ## Description A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length calculation to underflow, leading to a crash of the process parsing the header. On an RTSP server this can be triggered by a remote, unauthenticated attacker sending a single malformed request when the server has authentication enabled; the same flaw can also be triggered against an RTSP client by a malicious or compromised RTSP server. Successful exploitation results in a denial of service (application crash) and has no confirmed impact on confidentiality or integrity. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | gst-plugins-base1.0 Debian 12.15 (bookworm) | 1.22.0-3+deb12u7 | [DEBIAN-CVE-2026-85150](https://patchblox.com/security/data/fix/linux/debian-cve-2026-85150.md) | Sep 17, 2026 | | Linux | gst-plugins-base1.0 Debian 14 | 1.28.7-1 | [DEBIAN-CVE-2026-85150](https://patchblox.com/security/data/fix/linux/debian-cve-2026-85150.md) | Sep 17, 2026 | | Linux | gstreamer1-plugins-base RHEL 10 | 1.26.7-2.el10_2.2 | [RHSA-2026:66460](https://patchblox.com/security/data/fix/linux/rhsa-2026-66460.md) | Sep 12, 2026 | | Linux | gstreamer1-plugins-base RHEL 8 | 0:1.16.1-7.el8_10 | [RHSA-2026:67145](https://patchblox.com/security/data/fix/linux/rhsa-2026-67145.md) | Sep 19, 2026 | | Linux | gstreamer1-plugins-base RHEL 9 | 0:1.22.12-8.el9_8.2 | [RHSA-2026:69100](https://patchblox.com/security/data/fix/linux/rhsa-2026-69100.md) | Sep 22, 2026 | | Linux | gstreamer1-plugins-base almalinux 10 | 1.26.7-2.el10_2.2 | [ALSA-2026:66460](https://patchblox.com/security/data/fix/linux/alsa-2026-66460.md) | Sep 10, 2026 | | Linux | gstreamer1-plugins-base almalinux 8 | 1.16.1-7.el8_10 | [ALSA-2026:67145](https://patchblox.com/security/data/fix/linux/alsa-2026-67145.md) | Sep 14, 2026 | | Linux | gstreamer1-plugins-base almalinux 9 | 1.22.12-8.el9_8.2 | [ALSA-2026:69100](https://patchblox.com/security/data/fix/linux/alsa-2026-69100.md) | Sep 21, 2026 | | Linux | gstreamer1-plugins-base amzn 2023 | 1.24.10-1.amzn2023.0.5 | [ALAS2023-2026-3106](https://patchblox.com/security/data/fix/linux/alas2023-2026-3106.md) | Sep 28, 2026 | | Linux | gstreamer1-plugins-base ol 10 | 0:1.26.7-2.el10_2.2 | [ELSA-2026-66460-0](https://patchblox.com/security/data/fix/linux/elsa-2026-66460-0.md) | Sep 11, 2026 | | Linux | gstreamer1-plugins-base ol 8 | 0:1.16.1-7.0.1.el8_10 | [ELSA-2026-67145-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67145-0.md) | Sep 14, 2026 | | Linux | gstreamer1-plugins-base ol 9 | 0:1.22.12-8.el9_8.2 | [ELSA-2026-69100](https://patchblox.com/security/data/fix/linux/elsa-2026-69100.md) | Sep 21, 2026 | | Linux | gstreamer1-plugins-base rocky 10 | 0:1.26.7-2.el10_2.2 | [RLSA-2026:66460](https://patchblox.com/security/data/fix/linux/rlsa-2026-66460.md) | Sep 11, 2026 | | Linux | gstreamer1-plugins-base rocky 8 | 0:1.16.1-7.el8_10 | [RLSA-2026:67145](https://patchblox.com/security/data/fix/linux/rlsa-2026-67145.md) | Sep 15, 2026 | | Linux | gstreamer1-plugins-base rocky 9 | 0:1.22.12-8.el9_8.2 | [RLSA-2026:69100](https://patchblox.com/security/data/fix/linux/rlsa-2026-69100.md) | Sep 22, 2026 | | Linux | gstreamer1-plugins-base-debuginfo amzn 2023 | 1.24.10-1.amzn2023.0.5 | [ALAS2023-2026-3106](https://patchblox.com/security/data/fix/linux/alas2023-2026-3106.md) | Sep 28, 2026 | | Linux | gstreamer1-plugins-base-debugsource amzn 2023 | 1.24.10-1.amzn2023.0.5 | [ALAS2023-2026-3106](https://patchblox.com/security/data/fix/linux/alas2023-2026-3106.md) | Sep 28, 2026 | | Linux | gstreamer1-plugins-base-devel RHEL 8 | 0:1.16.1-7.el8_10 | [RHSA-2026:67145](https://patchblox.com/security/data/fix/linux/rhsa-2026-67145.md) | Sep 19, 2026 | | Linux | gstreamer1-plugins-base-devel RHEL 9 | 0:1.22.12-8.el9_8.2 | [RHSA-2026:69100](https://patchblox.com/security/data/fix/linux/rhsa-2026-69100.md) | Sep 22, 2026 | | Linux | gstreamer1-plugins-base-devel almalinux 10 | 1.26.7-2.el10_2.2 | [ALSA-2026:66460](https://patchblox.com/security/data/fix/linux/alsa-2026-66460.md) | Sep 10, 2026 | | Linux | gstreamer1-plugins-base-devel almalinux 8 | 1.16.1-7.el8_10 | [ALSA-2026:67145](https://patchblox.com/security/data/fix/linux/alsa-2026-67145.md) | Sep 14, 2026 | | Linux | gstreamer1-plugins-base-devel amzn 2023 | 1.24.10-1.amzn2023.0.5 | [ALAS2023-2026-3106](https://patchblox.com/security/data/fix/linux/alas2023-2026-3106.md) | Sep 28, 2026 | | Linux | gstreamer1-plugins-base-devel ol 10 | 0:1.26.7-2.el10_2.2 | [ELSA-2026-66460-0](https://patchblox.com/security/data/fix/linux/elsa-2026-66460-0.md) | Sep 11, 2026 | | Linux | gstreamer1-plugins-base-devel ol 8 | 0:1.16.1-7.0.1.el8_10 | [ELSA-2026-67145-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67145-0.md) | Sep 14, 2026 | | Linux | gstreamer1-plugins-base-devel ol 9 | 0:1.22.12-8.el9_8.2 | [ELSA-2026-69100](https://patchblox.com/security/data/fix/linux/elsa-2026-69100.md) | Sep 21, 2026 | | Linux | gstreamer1-plugins-base-tools RHEL 9 | 0:1.22.12-8.el9_8.2 | [RHSA-2026:69100](https://patchblox.com/security/data/fix/linux/rhsa-2026-69100.md) | Sep 22, 2026 | | Linux | gstreamer1-plugins-base-tools almalinux 10 | 1.26.7-2.el10_2.2 | [ALSA-2026:66460](https://patchblox.com/security/data/fix/linux/alsa-2026-66460.md) | Sep 10, 2026 | | Linux | gstreamer1-plugins-base-tools amzn 2023 | 1.24.10-1.amzn2023.0.5 | [ALAS2023-2026-3106](https://patchblox.com/security/data/fix/linux/alas2023-2026-3106.md) | Sep 28, 2026 | | Linux | gstreamer1-plugins-base-tools ol 10 | 0:1.26.7-2.el10_2.2 | [ELSA-2026-66460-0](https://patchblox.com/security/data/fix/linux/elsa-2026-66460-0.md) | Sep 11, 2026 | | Linux | gstreamer1-plugins-base-tools ol 9 | 0:1.22.12-8.el9_8.2 | [ELSA-2026-69100](https://patchblox.com/security/data/fix/linux/elsa-2026-69100.md) | Sep 21, 2026 | | Linux | gstreamer1-plugins-base-tools-debuginfo amzn 2023 | 1.24.10-1.amzn2023.0.5 | [ALAS2023-2026-3106](https://patchblox.com/security/data/fix/linux/alas2023-2026-3106.md) | Sep 28, 2026 | --- Data as of 2026-11-10T07:50:38Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.