Threats affecting pkg:rpm/redhat/gstreamer1-plugins-bad-free

Two security vulnerabilities were identified in the gstreamer1-plugins-bad-free package used in Red Hat Enterprise Linux 9.2. The first is a heap out-of-bounds write in the rfbsrc/librfb Hextile code with 16bpp framebuffer (CVE-2026-59691). The second is a stack buffer overflow in the DTLS certificate Subject DN processing within the openssl_verify_callback function (CVE-2026-59692). These issues could lead to memory corruption. Red Hat has released security updates addressing these flaws in version 1.18.4-9.el9_2.5 of the package for multiple architectures. The update is rated as Important by Red Hat Product Security.

A heap out-of-bounds write vulnerability exists in the IMA/DVI ADPCM decoder of the gstreamer1-plugins-bad-free package in Red Hat Enterprise Linux 10. This issue is addressed in version 10.2.7. The vulnerability is rated as having high security impact by Red Hat Product Security.

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720) * gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Multiple remote code execution vulnerabilities have been identified in GStreamer plugins, including heap-based buffer overflows and integer overflow issues affecting JPEG parsing, RTP depayloading, and AVI file handling. These vulnerabilities affect Red Hat Enterprise Linux 9.4 Extended Update Support and related packages. Red Hat has issued an important security advisory with updates to address these issues.

Multiple security vulnerabilities have been identified in GStreamer plugins included in Red Hat Enterprise Linux 10.0 Extended Update Support. These vulnerabilities include arbitrary code execution and remote code execution via heap-based buffer overflows, integer overflows, and out-of-bounds writes in various media file parsers and demuxers such as ASF, JPEG, AVI, RealMedia, RTP, and DVB subtitles. Red Hat has issued an important security advisory (RHSA-2026:8854) addressing these issues with updated packages. The vulnerabilities affect several GStreamer plugin packages: bad-free, base, good, and ugly-free. The advisory provides updated packages for multiple architectures and product variants. The severity is rated as high by the source. Patch availability is confirmed through the advisory with instructions for applying updates.

A stack-based buffer overflow vulnerability exists in the GStreamer H265 codec parsing within the gstreamer1-plugins-bad-free package for Red Hat Enterprise Linux 9.4. This flaw could allow remote code execution if exploited. Red Hat has issued a security update addressing this issue in version 9.4 of the affected packages.