| Name | CVE-2026-12893 |
| Description | gstreamer1-libav: gstreamer1-libav: NULL pointer dereference in gstavdemux.c error handler |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| gst-libav1.0 (PTS) | bullseye | 1.18.4-3 | vulnerable |
| bookworm | 1.22.0-2 | vulnerable | |
| trixie (security), trixie | 1.26.2-1+deb13u1 | vulnerable | |
| forky, sid | 1.28.5-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| gst-libav1.0 | source | (unstable) | 1.28.4-1 |
[trixie] - gst-libav1.0 <no-dsa> (Minor issue)
[bookworm] - gst-libav1.0 <postponed> (Minor issue)
[bullseye] - gst-libav1.0 <postponed> (Minor issue)
https://gstreamer.freedesktop.org/security/sa-2026-0038.html
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11802
Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/f904dfda677a0c148de8c391f3dbb11490c7e026 (1.29.2)
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11823 (1.28 backport)
Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/ea6e333c53e5fbae113804e03cbd6a53c4da5c3f (1.28.4)
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11828 (1.26 backport)
Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/2db03e541d9e3bb4cd8d02ce519d5c8e091dd8e3 (1.26 branch)
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11824 (1.24 backport)
Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/f9a43351c18cef873e4d2d062d0d388ce0cf21a7 (1.24 branch)