CVE-2026-121629 is a vulnerability in GStreamer's adaptive streaming demuxers (HLS, DASH, MSS) used in Red Hat Enterprise Linux 10. It allows an attacker who controls or can inject content into a media manifest to include file:// URIs that cause the application to read arbitrary local files. This can lead to disclosure of sensitive local files in automated or server-side deployments. The vulnerability affects RHEL 10.2 and later streams shipping gstreamer1-plugins-good 1.26.x or newer, Fedora 43, and Fedora 44 and Rawhide versions prior to 1.28.9. RHEL 9 and earlier are not affected. Mitigations include avoiding untrusted manifest sources and restricting filesystem access via containers or namespaces.
Multiple remote code execution vulnerabilities have been identified in the GStreamer streaming media framework, specifically within the gstreamer1-plugins-good package. These include heap-based buffer overflows in MRF and PNG file parsing, and a use-after-free in the rtpsbcdepay component. The vulnerabilities affect Red Hat Enterprise Linux 7 Extended Lifecycle Support versions. Red Hat has released security updates addressing these issues.
A use-after-free vulnerability in the rtpsbcdepay plugin of the gstreamer1-plugins-good package for Red Hat Enterprise Linux 10 allows remote code execution. This security flaw is addressed by an update provided by Red Hat. The vulnerability is rated as having high severity by Red Hat Product Security. The issue affects multiple architectures and variants of Red Hat Enterprise Linux 10. Users are advised to apply the official security update to remediate the vulnerability.
Two heap-based buffer overflow vulnerabilities in the gstreamer1-plugins-good package for Red Hat Enterprise Linux 10 can lead to remote code execution. These flaws occur during parsing of MRF and PNG files. Red Hat has issued an important security update to address these issues.
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.
Security Fix(es):
* gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write (CVE-2026-73433)
* gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing (CVE-2026-73434)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A security vulnerability (CVE-2026-5056) affecting the gstreamer1-plugins-good package in Red Hat Enterprise Linux 10 allows arbitrary code execution via a stack-based buffer overflow in the qtdemux plugin. This vulnerability is rated as important by Red Hat Product Security. A security update addressing this issue is available for multiple architectures of Red Hat Enterprise Linux 10 and its extended support versions.
Multiple remote code execution vulnerabilities have been identified in GStreamer plugins, including heap-based buffer overflows and integer overflow issues affecting JPEG parsing, RTP depayloading, and AVI file handling. These vulnerabilities affect Red Hat Enterprise Linux 9.4 Extended Update Support and related packages. Red Hat has issued an important security advisory with updates to address these issues.
Multiple security vulnerabilities have been identified in GStreamer plugins included in Red Hat Enterprise Linux 10.0 Extended Update Support. These vulnerabilities include arbitrary code execution and remote code execution via heap-based buffer overflows, integer overflows, and out-of-bounds writes in various media file parsers and demuxers such as ASF, JPEG, AVI, RealMedia, RTP, and DVB subtitles. Red Hat has issued an important security advisory (RHSA-2026:8854) addressing these issues with updated packages. The vulnerabilities affect several GStreamer plugin packages: bad-free, base, good, and ugly-free. The advisory provides updated packages for multiple architectures and product variants. The severity is rated as high by the source. Patch availability is confirmed through the advisory with instructions for applying updates.