Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
GStreamer Good Plugins can cause crashes and memory overload
published 2 months ago
Summary
The GStreamer media framework’s “good” plug‑in package on your Linux servers can let specially crafted video streams cause the program to use more and more memory or read and write beyond its limits. This can make the service crash or give an attacker a way to tamper with data. Update the package to the latest version as soon as possible.
What to do
- Update almalinux gstreamer1-plugins-good to version 1.16.1-7.el8_10.3.
- Update almalinux gstreamer1-plugins-good-gtk to version 1.16.1-7.el8_10.3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | gstreamer1-plugins-good |
< 1.16.1-7.el8_10.3 Fix: upgrade to 1.16.1-7.el8_10.3
|
| AlmaLinux:8 | almalinux | gstreamer1-plugins-good-gtk |
< 1.16.1-7.el8_10.3 Fix: upgrade to 1.16.1-7.el8_10.3
|
Original advisory text
Moderate: gstreamer1-plugins-good security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.
Security Fix(es):
* gst-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders (CVE-2026-18649)
* gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write (CVE-2026-73433)
* gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing (CVE-2026-73434)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* gst-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders (CVE-2026-18649)
* gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write (CVE-2026-73433)
* gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing (CVE-2026-73434)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:56966 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-18649 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-73433 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-73434 Third Party Advisory
- https://bugzilla.redhat.com/2510614 Third Party Advisory
- https://bugzilla.redhat.com/2514801 Third Party Advisory
- https://bugzilla.redhat.com/2514807 Third Party Advisory
- https://errata.almalinux.org/8/ALSA-2026-56966.html Vendor Advisory
Timeline
Published19 Aug 2026
Updated20 Aug 2026
First seen20 Aug 2026
Sources
ALSA-2026:56966 · OSV
Track software like this
Free during beta