Catalogo CVE

CVE-2026-12893

gst-libav1.0 affected and fixed versions

[Catalogo CVE]

A flaw was found in the GStreamer gst-libav plugin. A NULL pointer dereference in the demuxer error handler can be triggered when processing malformed media files, such as crafted Musepack (.mpc) files. When a user or application opens such a file using GStreamer, the application crashes, resulting in a denial of service. This flaw affects Red Hat Enterprise Linux versions that ship gstreamer1-libav packages. The impact is limited to denial of service (application crash) when processing maliciously crafted media files. Modern operating systems with NULL page protection prevent this from being exploited for code execution. The vulnerability requires local access to a malformed media file and user interaction to trigger. Applications using GStreamer to process untrusted media files (media players, video editors, thumbnail generators, file indexers) are affected. Network-facing services that automatically process uploaded media may also be impacted, but this requires the attacker to upload a malformed file and depends on service configuration. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Gravità
Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiansidgst-libav1.01.28.4-1FixedDistribution-reported fixed boundary[CVE-2026-12893]
Debiansidgst-libav1.01.28.8-1Fixed[CVE-2026-12893]
Debianforkygst-libav1.01.28.4-1FixedDistribution-reported fixed boundary[CVE-2026-12893]
Debianforkygst-libav1.01.28.8-1Fixed[CVE-2026-12893]

Showing 4 fix observations. All 10 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
UnknownRelease not reportedgst-libav1.0Not reportedUnknownSource applicability is not establishedProvider not reported
Debianbookwormgst-libav1.0Not reportedAffectedDistribution reports no fix[CVE-2026-12893]
Debianbookwormgst-libav1.01.22.0-2Affected[CVE-2026-12893]
Debianforkygst-libav1.01.28.4-1FixedDistribution-reported fixed boundary[CVE-2026-12893]
Debianforkygst-libav1.01.28.8-1Fixed[CVE-2026-12893]
Debiansidgst-libav1.01.28.4-1FixedDistribution-reported fixed boundary[CVE-2026-12893]
Debiansidgst-libav1.01.28.8-1Fixed[CVE-2026-12893]
Debiantrixiegst-libav1.0Not reportedAffectedDistribution reports no fix[CVE-2026-12893]
Debiantrixiegst-libav1.01.26.2-1+deb13u1Affected[CVE-2026-12893]
Debiantrixie-securitygst-libav1.01.26.2-1+deb13u1Affected[CVE-2026-12893]
Original provider fields
{
  "package_releases": [
    {
      "name": "gst-libav1.0",
      "status": "fixed",
      "release": "sid",
      "version": "1.28.8-1"
    },
    {
      "name": "gst-libav1.0",
      "status": "fixed",
      "release": "forky",
      "version": "1.28.8-1"
    },
    {
      "name": "gst-libav1.0",
      "status": "vulnerable",
      "release": "trixie",
      "version": "1.26.2-1+deb13u1"
    },
    {
      "name": "gst-libav1.0",
      "status": "vulnerable",
      "release": "trixie-security",
      "version": "1.26.2-1+deb13u1"
    },
    {
      "name": "gst-libav1.0",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "1.22.0-2"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "gst-libav1.0",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "1.28.4-1"
    },
    {
      "bug": null,
      "name": "gst-libav1.0",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "1.28.4-1"
    },
    {
      "bug": null,
      "name": "gst-libav1.0",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "gst-libav1.0",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "gst-libav1.0",
      "fixed_version": "not yet fixed",
      "applicability_unknown": true
    }
  ]
}

Publisher notes

[trixie] gst-libav1.0: Minor issue [bookworm] gst-libav1.0: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [gstreamer1.0-libav]Sconosciuto

    Pacchetto sorgente: [gst-libav1.0]

    Dettagli (2)

    • 1.22.0-2 · amd64 · bookworm

      Sconosciuto · Corretta: 1.28.4-1

      Version impact unknown

      dsa · gst-libav1.0 · debian · bookworm; pypi · gst-libav1.0 · debian · 12; pypi · gst-libav1.0 · debian · 13; pypi · gst-libav1.0 · debian · 14

    • 1.22.0-2 · arm64 · bookworm

      Sconosciuto · Corretta: 1.28.4-1

      Version impact unknown

      dsa · gst-libav1.0 · debian · bookworm; pypi · gst-libav1.0 · debian · 12; pypi · gst-libav1.0 · debian · 13; pypi · gst-libav1.0 · debian · 14

[Debian 13 (Trixie)]

  • [gstreamer1.0-libav]Sconosciuto

    Pacchetto sorgente: [gst-libav1.0]

    Dettagli (4)

    • 1.26.2-1+deb13u1 · amd64 · trixie

      Sconosciuto · Corretta: 1.28.4-1

      Version impact unknown

      dsa · gst-libav1.0 · debian · bookworm; pypi · gst-libav1.0 · debian · 12; pypi · gst-libav1.0 · debian · 13; pypi · gst-libav1.0 · debian · 14

    • 1.26.2-1+deb13u1 · arm64 · trixie

      Sconosciuto · Corretta: 1.28.4-1

      Version impact unknown

      dsa · gst-libav1.0 · debian · bookworm; pypi · gst-libav1.0 · debian · 12; pypi · gst-libav1.0 · debian · 13; pypi · gst-libav1.0 · debian · 14

    • 1.26.2-1+deb13u1 · amd64 · trixie-security

      Sconosciuto · Corretta: 1.28.4-1

      Version impact unknown

      dsa · gst-libav1.0 · debian · bookworm; pypi · gst-libav1.0 · debian · 12; pypi · gst-libav1.0 · debian · 13; pypi · gst-libav1.0 · debian · 14

    • 1.26.2-1+deb13u1 · arm64 · trixie-security

      Sconosciuto · Corretta: 1.28.4-1

      Version impact unknown

      dsa · gst-libav1.0 · debian · bookworm; pypi · gst-libav1.0 · debian · 12; pypi · gst-libav1.0 · debian · 13; pypi · gst-libav1.0 · debian · 14

Osservato:

Riferimenti

[CERT-Bund public advisories] · [Debian Security Tracker] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]