Is CVE-2026-119728 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119728 being exploited in the wild.

How severe is CVE-2026-119728?

Medium severity, with a CVSS score of 5.5, published 30 October 2026.

Which products and versions are affected?

Gstreamer Gst-Plugins-Bad before 1.28.2.

Is there a fix for CVE-2026-119728?

Yes: fixed in gst-plugins-bad 1.28.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-119728 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-119728?

Check whether you run Gstreamer Gst-Plugins-Bad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119728: GStreamer gst-plugins-bad NULL pointer dereference in H.264 MVC parser

CVE-2026-119728 · Severity: medium · CVSS 5.5 · Published 2026-10-30

GStreamer's H.264 video parser contains a flaw that crashes applications when processing specially crafted video files with malformed Multiview stereo data. An attacker can exploit this by distributing a malicious video file that causes the application to crash, resulting in denial of service for users who play the file.

Technologies: Gstreamer Gst-Plugins-Bad. Vendors: Gstreamer.

Quick answers

Is CVE-2026-119728 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119728 being exploited in the wild.
How severe is CVE-2026-119728?: Medium severity, with a CVSS score of 5.5, published 30 October 2026.
Which products and versions are affected?: Gstreamer Gst-Plugins-Bad before 1.28.2.
Is there a fix for CVE-2026-119728?: Yes: fixed in gst-plugins-bad 1.28.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119728 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-119728?: Check whether you run Gstreamer Gst-Plugins-Bad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: gst-plugins-bad 1.28.2

Technical details

A NULL pointer dereference (CWE-476) occurs in the H.264 MVC (Multiview Coding) Sequence Parameter Set parser during cleanup of partially allocated structures after a parse failure. The vulnerability is triggered only when processing H.264 content with MULTIVIEW_HIGH or STEREO_HIGH profile Subset SPS NAL units; standard AVC streams are unaffected. Attack requires user interaction to process malicious video content via a local file.

Affected products

GStreamer gst-plugins-bad before 1.28.2

Timeline

2026-10-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.