Read the docs
TI-2026-58485 Aliases CVE-2026-85150GHSA-q4wf-cmpg-8rhf

NULL pointer dereference in Red Hat Enterprise Linux 10

Priority LOW 39CWE-476Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 3 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-476.

Summary

A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length calculation to underflow, leading to a crash of the process parsing the header. On an RTSP server this can be triggered by a remote, unauthenticated attacker sending a single malformed request when the server has authentication enabled; the same flaw can also be triggered against an RTSP client by a malicious or compromised RTSP server. Successful exploitation results in a denial of service (application crash) and has no confirmed impact on confidentiality or integrity.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0053 45th percentileScored 2026-11-07
Fix Partial Red Hat: 3 advisoriesRed Hat: 3 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat Enterprise Linux 10—1.26.7-2.el10_2.2Patch availableCNA
Red HatRed Hat Enterprise Linux 8—1.16.1-7.el8_10Patch availableCNA
Red HatRed Hat Enterprise Linux 9—1.22.12-8.el9_8.2Patch availableCNA
Red HatRed Hat Enterprise Linux 7——No fix listedCNA
  • Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in 1.26.7-2.el10_2.2 Patch available CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 1.16.1-7.el8_10 Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 1.22.12-8.el9_8.2 Patch available CNA
  • Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — No fix listed CNA

CPE names CNA · 4

CPEVersionsRoleVendor
cpe:/o:redhat:enterprise_linux:10.210.2—Red Hat
cpe:/a:redhat:enterprise_linux:8::appstream8—Red Hat
cpe:/a:redhat:enterprise_linux:9::appstream9—Red Hat
cpe:/o:redhat:rhel_els:77—Red Hat
  • cpe:/o:redhat:enterprise_linux:10.2 Versions 10.2 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:8::appstream Versions 8 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:9::appstream Versions 9 — ·Red Hat
  • cpe:/o:redhat:rhel_els:7 Versions 7 — ·Red Hat

Remediation

Red Hat 3 advisories

  • RHSA-2026:69100 Released 2026-09-21 · Red Hat rating Important
    gstreamer1-plugins-base security update
    • Red Hat Enterprise Linux AppStream (v. 9) gstreamer1-plugins-base-1.22.12-8.el9_8.2, gstreamer1-plugins-base-devel-1.22.12-8.el9_8.2, gstreamer1-plugins-base-tools-1.22.12-8.el9_8.2
  • RHSA-2026:67145 Released 2026-09-14 · Red Hat rating Moderate
    gstreamer1-plugins-base security update
    • Red Hat Enterprise Linux AppStream (v. 8) gstreamer1-plugins-base-1.16.1-7.el8_10, gstreamer1-plugins-base-devel-1.16.1-7.el8_10
  • RHSA-2026:66460 Released 2026-09-11 · Red Hat rating Moderate
    gstreamer1-plugins-base security update
    • Red Hat Enterprise Linux AppStream (v. 10) gstreamer1-plugins-base-1.26.7-2.el10_2.2, gstreamer1-plugins-base-devel-1.26.7-2.el10_2.2, gstreamer1-plugins-base-tools-1.26.7-2.el10_2.2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:66460
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:67145
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:69100

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-85150
  2. 2026-10-03 Alias added: GHSA-q4wf-cmpg-8rhf

References

Advisory 3

Other 4

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences