Most recent entries from all

ALSA-2026:59152 — Important: gstreamer1-plugins-good security update

Affected: AlmaLinux:9: gstreamer1-plugins-good, AlmaLinux:9: gstreamer1-plugins-good-gtk

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.

Security Fix(es):

* gstreamer: GStreamer: Remote Code Execution via MRF file parsing heap-based buffer overflow (CVE-2026-18296) * gstreamer: GStreamer: Remote code execution via heap-based buffer overflow in PNG file parsing (CVE-2026-18298) * gstreamer: GStreamer: Remote Code Execution via Use-After-Free in rtpsbcdepay (CVE-2026-18299) * GStreamer: GStreamer: Remote code execution via MRF file parsing (CVE-2026-18295)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

EUVD-2026-360148

fkie_cve-2026-18299

The specific flaw exists within the processing of RTP payload elements. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29787.

GHSA-7xww-j5h2-23gh

OESA-2026-4053 — gstreamer1-plugins-good security update

Affected: openEuler:24.03-LTS-SP3: gstreamer1-plugins-good

GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins. Security Fix(es):

GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of MRF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29510.(CVE-2026-18295)

GStreamer MRF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of MRF files. The issue results from the lack of proper validation o…

RHSA-2026:59152 — Red Hat Security Advisory: gstreamer1-plugins-good security update

gstreamer-plugins-good: GStreamer: Remote code execution via MRF file parsing gstreamer-plugins-good: GStreamer: Remote Code Execution via MRF file parsing heap-based buffer overflow gstreamer-plugins-good: GStreamer: Remote code execution via heap-based buffer overflow in PNG file parsing gstreamer-plugins-good: GStreamer: Remote Code Execution via Use-After-Free in rtpsbcdepay

RHSA-2026:71646 — Red Hat Security Advisory: gstreamer1-plugins-good security update

RLSA-2026:59152 — Important: gstreamer1-plugins-good security update

Affected: Rocky Linux:9: gstreamer1-plugins-good

Security Fix(es):

* gstreamer: GStreamer: Remote Code Execution via MRF file parsing heap-based buffer overflow (CVE-2026-18296)

* gstreamer: GStreamer: Remote code execution via heap-based buffer overflow in PNG file parsing (CVE-2026-18298)

* gstreamer: GStreamer: Remote Code Execution via Use-After-Free in rtpsbcdepay (CVE-2026-18299)

* GStreamer: GStreamer: Remote code execution via MRF file parsing (CVE-2026-18295)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

UBUNTU-CVE-2026-18299

Affected: Ubuntu:Pro:16.04:LTS: gst-plugins-good1.0, Ubuntu:Pro:18.04:LTS: gst-plugins-good1.0, Ubuntu:Pro:20.04:LTS: gst-plugins-good1.0, Ubuntu:22.04:LTS: gst-plugins-good1.0, Ubuntu:24.04:LTS: gst-plugins-good1.0, Ubuntu:26.04:LTS: gst-plugins-good1.0

GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of RTP payload elements. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29787.

WID-SEC-W-2026-2259 — GStreamer: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in GStreamer ausnutzen, um möglicherweise beliebigen Code auszuführen, Daten zu manipulieren oder einen Denial-of-Service-Zustand auszulösen.