The update fixes six distinct vulnerabilities: CVE-2025-4574 involves a race condition in the crossbeam-channel's internal Channel type Drop method that can cause double-free and memory corruption. CVE-2025-58160 allows terminal manipulation through injection of ANSI escape sequences in untrusted user input logged by tracing-subscriber. CVE-2026-25541 is an integer overflow in bytes::BytesMut::reserve that can cause undefined behavior and crashes. CVE-2026-25727 involves stack exhaustion due to parsing user input with the RFC 2822 date parser in the time crate. CVE-2026-72813 causes process crashes when an empty Range header is sent in GET requests for static files in actix-files. CVE-2026-72814 leads to information disclosure when non-existing folders are passed to actix_files::Files::new(). These vulnerabilities collectively impact memory safety, denial of service, and information exposure.

The vulnerabilities can lead to memory corruption, process crashes, denial of service via stack exhaustion, terminal manipulation potentially affecting user interface integrity, and information disclosure. These impacts can degrade system stability, compromise confidentiality, and potentially allow attackers to disrupt services or manipulate terminal output.

A security update has been released that addresses all listed vulnerabilities. Users of gstreamer-devtools and affected components should apply the update provided by the SUSE Product Security Team promptly to mitigate these issues. No additional mitigation steps are indicated beyond applying the official update.