There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264
    video file or network stream with malformed Multiview (MVC) Sequence Parameter Set data, the parser can
    dereference a NULL pointer during the cleanup of partially allocated internal structures after a parse
    failure. This can cause the application using GStreamer to crash, resulting in a denial of service.
    (CVE-2026-119728)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - 在 gst-plugins-bad 的 H.264 視訊剖析器中發現缺陷。處理具有格式錯誤的多檢視 （MVC） 序列參數集資料的特製 H.264 視訊檔案時，剖析器可以在剖析失敗之後清除部分配置的內部結構期間取消參照 NULL 指標。這可能會導致使用 GStreamer 的應用程式當機，進而造成拒絕服務。（CVE-2026-119728）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 在 gst-plugins-bad 中的 H.264 视频解析器中发现一个缺陷。处理具有畸形多视图 （MVC） 序列参数集数据的特别构建的 H.264 视频文件时，解析器可在解析失败后清理部分分配的内部结构期间取消引用空指针。这可导致使用 GStreamer 的应用程序崩溃，从而导致拒绝服务。（CVE-2026-119728）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - gst-plugins-bad の H.264 動画パーサーに欠陥が見つかりました。無効な形式のマルチビュー(MVC)シーケンスパラメーターセットデータを含む特別に細工された H.264 動画ファイルを処理する際に、パーサーが、解析失敗後に部分的に割り当てられた内部構造をクリーンアップするときに NULL ポインターを逆参照する可能性があります。これにより、GStreamerを使用するアプリケーションがクラッシュし、サービス拒否が発生する可能性があります。(CVE-2026-119728)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3424 advisory.

    A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265     bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer     settings, an integer underflow in the upper-bound computation allows the parser to accept an out-of-range     value for the number of palette predictor entries. This causes the parser to write beyond the end of a     fixed-size array, resulting in memory corruption and an application crash. Successful exploitation     requires an attacker to provide a malformed H.265 media file to a vulnerable application, and is limited     to a denial-of-service impact. (CVE-2026-119727)

    A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264     video file with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL     pointer during the cleanup of partially allocated internal structures after a parse failure. This can     cause the application using GStreamer to crash, resulting in a denial of service. (CVE-2026-119728)

    A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer     parser allows a remote attacker to cause a crash in applications that process AV1 media content. By     crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker can cause     integer overflow in the parser, resulting in incorrect length values being used during stream processing,     which can lead to a denial of service. (CVE-2026-119729)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of gstreamer1-plugins-bad-free installed on the remote host is prior to 1.18.4-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4094 advisory.

    A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265     bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer     settings, an integer underflow in the upper-bound computation allows the parser to accept an out-of-range     value for the number of palette predictor entries. This causes the parser to write beyond the end of a     fixed-size array, resulting in memory corruption and an application crash. Successful exploitation     requires an attacker to provide a malformed H.265 media file to a vulnerable application, and is limited     to a denial-of-service impact. (CVE-2026-119727)

    A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264     video file with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL     pointer during the cleanup of partially allocated internal structures after a parse failure. This can     cause the application using GStreamer to crash, resulting in a denial of service. (CVE-2026-119728)

    A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer     parser allows a remote attacker to cause a crash in applications that process AV1 media content. By     crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker can cause     integer overflow in the parser, resulting in incorrect length values being used during stream processing,     which can lead to a denial of service. (CVE-2026-119729)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264     video file or network stream with malformed Multiview (MVC) Sequence Parameter Set data, the parser can     dereference a NULL pointer during the cleanup of partially allocated internal structures after a parse     failure. This can cause the application using GStreamer to crash, resulting in a denial of service.
    (CVE-2026-119728)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
478159	Echo: gst-plugins-bad1.0: security update to 1.26.2-3+deb13u3+e4	Tenable Self-Hosted Container Security	Echo Local Security Checks	11/1/2026	11/4/2026	medium
478159	Echo: gst-plugins-bad1.0: security update to 1.26.2-3+deb13u3+e4	Tenable Cloud Security	Echo Local Security Checks	11/1/2026	11/4/2026	medium
374305	Linux Distros 未修補弱點：CVE-2026-119728	Nessus	Misc.	10/30/2026	11/5/2026	medium
374305	Linux Distros 未修补的漏洞：CVE-2026-119728	Nessus	Misc.	10/30/2026	11/5/2026	medium
374305	Linux Distros のパッチ未適用の脆弱性: CVE-2026-119728	Nessus	Misc.	10/30/2026	11/5/2026	medium
379874	Amazon Linux 2023 : gstreamer1-plugin-openh264, gstreamer1-plugins-bad-free, gstreamer1-plugins-bad-free-devel (ALAS2023-2026-3424)	Nessus	Amazon Linux Local Security Checks	11/12/2026	11/12/2026	medium
379821	Amazon Linux 2 : gstreamer1-plugins-bad-free (ALAS-2026-4094)	Nessus	Amazon Linux Local Security Checks	11/12/2026	11/12/2026	medium
374305	Linux Distros Unpatched Vulnerability : CVE-2026-119728	Nessus	Misc.	10/30/2026	11/5/2026	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium