CVE-2026-12893

Description

A flaw was found in the GStreamer gst-libav plugin. A NULL pointer dereference in the demuxer error handler can be triggered when processing malformed media files, such as crafted Musepack (.mpc) files. When a user or application opens such a file using GStreamer, the application crashes, resulting in a denial of service.

Statement

This flaw affects Red Hat Enterprise Linux versions that ship gstreamer1-libav packages. The impact is limited to denial of service (application crash) when processing maliciously crafted media files. Modern operating systems with NULL page protection prevent this from being exploited for code execution. The vulnerability requires local access to a malformed media file and user interaction to trigger. Applications using GStreamer to process untrusted media files (media players, video editors, thumbnail generators, file indexers) are affected. Network-facing services that automatically process uploaded media may also be impacted, but this requires the attacker to upload a malformed file and depends on service configuration.

Mitigation

Avoid opening untrusted media files from unknown sources until the package is updated. Organizations can implement application allowlisting to restrict which applications can process media files, or use sandboxing technologies (SELinux, AppArmor, containers) to limit the impact of crashes in media processing applications.

Understanding the Weakness (CWE)

CWE-476

Availability

Technical Impact: DoS: Crash, Exit, or Restart

NULL pointer dereferences usually result in the failure of the process unless exception handling (on some platforms) is available and implemented. Even when exception handling is being used, it can still be very difficult to return the software to a safe state of operation.

Integrity,Confidentiality

Technical Impact: Execute Unauthorized Code or Commands; Read Memory; Modify Memory

In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution.

Acknowledgements

Red Hat would like to thank Dr. Faruk Kazi (CoE-CNDS Lab, VJTI, Mumbai, India), Ramesh Adhikari (CoE-CNDS Lab, VJTI, Mumbai, India), Sukrut Chougule (CoE-CNDS Lab, VJTI, Mumbai, India), and Tarun Uikey (CoE-CNDS Lab, VJTI, Mumbai, India) for reporting this issue.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.