Red Hat Security Advisory: gstreamer1-plugins-good security update
Affects Red Hat Product Security Red HatSource GCVE Database
Mentioned vulnerabilities
Not known to be exploited.
Data as of 10/25/2026, 04:40:11 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 12% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Red Hatredhat/gstreamer1-plugins-goodpkg:rpm/redhat/gstreamer1-plugins-goodOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Red Hat has released updated gstreamer1-plugins-good packages that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:59133. No additional mitigation steps are indicated by the vendor.
Description
Two heap-based buffer overflow vulnerabilities in the gstreamer1-plugins-good package for Red Hat Enterprise Linux 10 can lead to remote code execution. These flaws occur during parsing of MRF and PNG files. Red Hat has issued an important security update to address these issues.
Impact
Successful exploitation of these heap-based buffer overflow vulnerabilities could allow remote attackers to execute arbitrary code on affected systems. This poses a significant security risk, potentially leading to system compromise.
Weaknesses
- CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #11
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
- CWE-787Out-of-bounds Write (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #5
The product writes data past the end, or before the beginning, of the intended buffer.
References
- access.redhat.com/errata/RHSA-2026:59133 (opens in a new tab)
- access.redhat.com/security/updates/classification/ (opens in a new tab)
- bugzilla.redhat.com/show_bug.cgi?id=2520580 (opens in a new tab)
- bugzilla.redhat.com/show_bug.cgi?id=2520590 (opens in a new tab)
- security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59133.json (opens in a new tab)