Red Hat Security Advisory: gstreamer1-plugins-good security update
Affects Red Hat Product Security Red HatSource GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 04:40:11 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Red Hatredhat/gstreamer1-plugins-goodpkg:rpm/redhat/gstreamer1-plugins-goodOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Red Hat has released an official security update that fixes this vulnerability in gstreamer1-plugins-good starting with version 10.2.8. Users should apply the update as soon as possible following Red Hat's guidance at https://access.redhat.com/articles/11258. No additional mitigation steps are required beyond applying the official patch.
Description
A use-after-free vulnerability in the rtpsbcdepay plugin of the gstreamer1-plugins-good package for Red Hat Enterprise Linux 10 allows remote code execution. This security flaw is addressed by an update provided by Red Hat. The vulnerability is rated as having high severity by Red Hat Product Security. The issue affects multiple architectures and variants of Red Hat Enterprise Linux 10. Users are advised to apply the official security update to remediate the vulnerability.
Impact
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely on affected systems running vulnerable versions of gstreamer1-plugins-good. This could lead to full compromise of the affected system depending on the privileges of the exploited process. The vulnerability is rated as having high security impact by Red Hat.
Summary
CVE-2026-18299 is a remote code execution vulnerability caused by a use-after-free condition in the rtpsbcdepay component of the gstreamer1-plugins-good package. This package is part of the GStreamer multimedia framework used in Red Hat Enterprise Linux 10. The vulnerability allows an attacker to execute arbitrary code remotely by exploiting the use-after-free flaw. Red Hat has released an updated package to fix this issue in version 10.2.8 and later.
Weaknesses
- CWE-386Symbolic Name not Mapping to Correct Object (opens in a new tab)
Base weakness
A constant symbolic reference to an object is used, even though the reference can resolve to a different object over time.