CVE-2026-12892: Gstreamer1-plugins-bad: gstreamer1-plugins-bad: 1-byte heap out-of-bounds read in h.264 nal extension slice parser
A 1-byte heap out-of-bounds read vulnerability exists in the gsth264parseprocessnal() function in subprojects/gst-plugins-bad/gst/videoparsers/gsth264parse.c. The function processes H.264 NAL units including GSTH264NALSLICEEXT (NAL type 20) for MVC/SVC extension slices. At line 1132, the code dereferences (nalu->data + nalu->offset + nalu->headerbytes) to check the firstmbinslice flag without first verifying that nalu->size > nalu->headerbytes. For extension slice types, headerbytes is set to 4 (1 byte base + 3 bytes extension header per gsth264parser.c:243). A malformed NAL unit with exactly size==4 passes the minimum size check (size >= 2 at line 999) but triggers a 1-byte read at offset 4, which is beyond the allocated buffer. The same bounds check pattern is correctly implemented in gsth264parsecollectnal() at line 1259 with if (nalu->size > nalu->headerbytes). The vulnerability affects GStreamer 1.x versions (tested against git version 1.29.1.1). Upstream maintainer Sebastian Droege confirmed the vulnerability via GitLab work item 5108. Reported by Dr. Faruk Kazi, Ramesh Adhikari, and Ariba Afroz from CoE-CNDS Lab, VJTI, Mumbai, India. PSIRT Ticket: PSIRTSUPT-17585.
Other sources
A flaw was found in GStreamer's gst-plugins-bad package. When processing a specially crafted H.264 video file containing malformed MVC or SVC extension slice NAL units, a 1-byte heap out-of-bounds read can occur during parsing. This happens when the parser attempts to check slice boundary information without first verifying that the NAL unit contains enough data beyond the extension header. An attacker could exploit this by tricking a user into opening a malicious H.264 video file, potentially causing the application to crash or leak a single byte of heap memory.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gstreamer1-plugins-badto a version that resolves this vulnerability.Patch PSIRTSUPT-17585 - Configuration
In gst_h264_parse_process_nal() (gsth264parse.c), add/ensure a bounds check equivalent to gst_h264_parse_collect_nal() at line 1259 ("if (nalu->size > nalu->header_bytes)") before dereferencing *(nalu->data + nalu->offset + nalu->header_bytes) to read the first_mb_in_slice flag. This prevents the 1-byte out-of-bounds read that can be triggered when size==4 passes a too-loose minimum-size check but header_bytes==4 for extension slice types.
GStreamer gst-plugins-bad (gsth264parse.c / gst_h264_parse_process_nal) NAL unit bounds check for slice-boundary dereference = Require nalu->size > nalu->header_bytes before accessing *(nalu->data + nalu->offset + nalu->header_bytes) - Compensating control
If possible, avoid opening untrusted/malicious H.264 files that could contain malformed MVC/SVC extension slice NAL units (GST_H264_NAL_SLICE_EXT / NAL type 20) until the fix for PSIRTSUPT-17585 is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12892?
The severity of CVE-2026-12892 is rated medium with a score of 4.4.
How do I fix CVE-2026-12892?
To fix CVE-2026-12892, you should update GStreamer to the latest version that addresses this vulnerability.
What causes CVE-2026-12892?
CVE-2026-12892 is caused by a 1-byte heap out-of-bounds read that occurs when parsing incorrectly formed H.264 video files.
What software is affected by CVE-2026-12892?
CVE-2026-12892 affects the GStreamer gst-plugins-bad package.
Is CVE-2026-12892 easy to exploit?
CVE-2026-12892 has a low attack complexity, as it can be exploited by a user in possession of a specially crafted video file.