Description

A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length calculation to underflow, leading to a crash of the process parsing the header. On an RTSP server this can be triggered by a remote, unauthenticated attacker sending a single malformed request when the server has authentication enabled; the same flaw can also be triggered against an RTSP client by a malicious or compromised RTSP server. Successful exploitation results in a denial of service (application crash) and has no confirmed impact on confidentiality or integrity.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-03T13:06:21.910Z",
  "pubdate": "2026-09-03T13:06:21.910Z",
  "executiveSummary": "A NULL pointer dereference vulnerability exists within the GStreamer RTSP support library, specifically affecting the parsing logic for Digest authentication headers.\nThe flaw stems from an integer underflow occurring during the calculation of parameter lengths when processing malformed whitespace within Authorization or WWW-Authenticate headers.\nThis vulnerability is remotely exploitable without authentication, enabling a Denial of Service (DoS) attack that results in an immediate application crash.\nBoth RTSP servers (if authentication is enabled) and RTSP clients are susceptible to exploitation by malicious peers.\nWhile the primary impact is limited to service availability, the lack of required authentication makes this a critical stability issue for affected multimedia streaming architectures.\nSuccessful exploitation requires only a single, specially crafted malformed RTSP request or response, making it highly accessible to attackers.",
  "technicalDetails": "The vulnerability resides in the header parsing routines of the GStreamer RTSP library responsible for handling Digest authentication. The flaw is triggered when the parser encounters a malformed RTSP Authorization or WWW-Authenticate header containing specific whitespace arrangements surrounding a parameter terminator.\nRoot Cause: During the processing of the authentication string, the parser attempts to calculate the length of individual parameters. If an attacker provides a carefully crafted sequence of characters around the parameter delimiters, the length calculation logic performs an unsigned integer subtraction that results in an integer underflow. This underflow produces an erroneous, unexpectedly large length value, which is subsequently used as an offset or reference for memory operations.\nExploitation Method: An attacker exploits this by injecting a malicious RTSP request (against a server) or an RTSP response (against a client) containing the manipulated authentication header. When the GStreamer library attempts to parse this header, the internal length calculation fails, leading the application to reference a memory address that is invalid or NULL. This results in a segmentation fault or NULL pointer dereference, causing the host process to crash abruptly.\nAttack Flow: 1. The attacker identifies an RTSP endpoint or client utilizing the vulnerable GStreamer library. 2. For server-side targets, the attacker sends an RTSP request (e.g., OPTIONS or DESCRIBE) with a maliciously formatted Authorization header. For client-side targets, a malicious RTSP server returns a crafted WWW-Authenticate header in response to a standard request. 3. The GStreamer parsing component processes the header and performs the flawed length calculation. 4. The subsequent memory access violation crashes the service process, resulting in a Denial of Service.\nImpact: The primary impact is a confirmed Denial of Service (DoS). The process terminates immediately upon reaching the vulnerable code path. There is no evidence at this time to suggest that this vulnerability leads to remote code execution (RCE) or the compromise of system confidentiality or integrity, as the failure results in an immediate service crash rather than controlled memory corruption or redirection of control flow."
}