security update for gstreamer1-plugins-base
Affects SUSE Product Security Team SUSESource GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 04:40:11 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 14% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Red Hatredhat/gstreamer1-plugins-basepkg:rpm/redhat/gstreamer1-plugins-baseOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A patch is available from Red Hat as detailed in advisory RHSA-2026:59487. Users should apply the security update to gstreamer1-plugins-base promptly to remediate this vulnerability.
Description
A high severity arbitrary code execution vulnerability exists in gstreamer1-plugins-base due to a buffer overflow during OGG file parsing. This affects Red Hat Enterprise Linux 8 and related distributions. A security update addressing this issue is available from Red Hat as detailed in advisory RHSA-2026:59487.
Impact
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on affected systems. The vendor rates this vulnerability as high severity. There are no known exploits in the wild at this time.
Weaknesses
- CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #11
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
References
- access.redhat.com/errata/RHSA-2026:59487 (opens in a new tab)
- access.redhat.com/security/updates/classification/ (opens in a new tab)
- bugzilla.redhat.com/show_bug.cgi?id=2520572 (opens in a new tab)
- security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59487.json (opens in a new tab)
- access.redhat.com/errata/RHSA-2026:69531 (opens in a new tab)
- security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69531.json (opens in a new tab)
- suse.com/support/security/rating/ (opens in a new tab)
- ftp.suse.com/pub/projects/security/csaf/rhsa-2026_69100.json (opens in a new tab)
- lists.suse.com/pipermail/suse-liberty-linux-updates/2026-September/007975.html (opens in a new tab)
- suse.com/security/cve/CVE-2026-18297/ (opens in a new tab)
- suse.com/security/cve/CVE-2026-85150/ (opens in a new tab)
- ftp.suse.com/pub/projects/security/csaf/rhsa-2026_67890.json (opens in a new tab)
- lists.suse.com/pipermail/suse-liberty-linux-updates/2026-September/007916.html (opens in a new tab)