CVE-2026-119842 is a vulnerability in the GStreamer gst-plugins-base MicroDVD subtitle parser used in Red Hat Enterprise Linux 10. It causes a NULL pointer dereference when processing specially crafted MicroDVD (.sub) subtitle files, leading to a crash of the media player application. The issue requires user interaction to trigger and results in denial of service without compromising confidentiality or integrity. The flaw is fixed in version 1.28.2 of gst-plugins-base.
A security vulnerability in the GStreamer streaming media framework's gstreamer1-plugins-base package allows arbitrary code execution via a buffer overflow in OGG file parsing. This issue is identified as CVE-2026-18297 and affects Red Hat Enterprise Linux 8.8 variants. Red Hat has issued an important security update to address this flaw.
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.
Security Fix(es):
* gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted Digest Authorization/WWW-Authenticate header (CVE-2026-85150)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Multiple remote code execution vulnerabilities have been identified in GStreamer plugins, including heap-based buffer overflows and integer overflow issues affecting JPEG parsing, RTP depayloading, and AVI file handling. These vulnerabilities affect Red Hat Enterprise Linux 9.4 Extended Update Support and related packages. Red Hat has issued an important security advisory with updates to address these issues.
Multiple security vulnerabilities have been identified in GStreamer plugins included in Red Hat Enterprise Linux 10.0 Extended Update Support. These vulnerabilities include arbitrary code execution and remote code execution via heap-based buffer overflows, integer overflows, and out-of-bounds writes in various media file parsers and demuxers such as ASF, JPEG, AVI, RealMedia, RTP, and DVB subtitles. Red Hat has issued an important security advisory (RHSA-2026:8854) addressing these issues with updated packages. The vulnerabilities affect several GStreamer plugin packages: bad-free, base, good, and ugly-free. The advisory provides updated packages for multiple architectures and product variants. The severity is rated as high by the source. Patch availability is confirmed through the advisory with instructions for applying updates.
Multiple moderate severity security vulnerabilities have been identified in the gstreamer1-plugins-base package used in Red Hat Enterprise Linux 9. These include out-of-bounds reads and writes, as well as NULL-pointer dereferences in various parsers such as ID3v2, SSA subtitle, format_channel_mask, and LRC subtitle parsers. Red Hat has released security updates addressing these issues for Red Hat Enterprise Linux 9 and its extended update and lifecycle support versions.
Multiple security vulnerabilities have been identified in the gstreamer1-plugins-base package used in Red Hat Enterprise Linux 8. These include stack-buffer overflows in vorbis_handle_identification_packet (CVE-2024-47538) and gst_opus_dec_parse_header (CVE-2024-47607), as well as an out-of-bounds write in the Ogg demuxer (CVE-2024-47615). These issues could potentially lead to memory corruption. Red Hat has released security updates addressing these vulnerabilities for various architectures and Extended Life Cycle versions of RHEL 8.