Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Red Hat GStreamer Good plugins can be tricked into running malicious code

published 1 month ago

Summary

The GStreamer good plugins packages for Red Hat (including the main, debug, source, and GTK variants) contain a flaw that could let an attacker execute unwanted code on a system that processes specially crafted media files. This could lead to unauthorized actions or data exposure. Apply the latest security update from Red Hat as soon as possible to close the gap.

What to do

Update redhat gstreamer1-plugins-good to version 0:1.22.12-5.el9_6.3.
Update redhat gstreamer1-plugins-good-debuginfo to version 0:1.22.12-5.el9_6.3.
Update redhat gstreamer1-plugins-good-debugsource to version 0:1.22.12-5.el9_6.3.
Update redhat gstreamer1-plugins-good-gtk to version 0:1.22.12-5.el9_6.3.
Update redhat gstreamer1-plugins-good-gtk-debuginfo to version 0:1.22.12-5.el9_6.3.
Update redhat gstreamer1-plugins-good-qt-debuginfo to version 0:1.22.12-5.el9_6.3.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_eus:9.6::appstream	redhat	gstreamer1-plugins-good	< 0:1.22.12-5.el9_6.3 Fix: upgrade to 0:1.22.12-5.el9_6.3
Red Hat:rhel_eus:9.6::appstream	redhat	gstreamer1-plugins-good-debuginfo	< 0:1.22.12-5.el9_6.3 Fix: upgrade to 0:1.22.12-5.el9_6.3
Red Hat:rhel_eus:9.6::appstream	redhat	gstreamer1-plugins-good-debugsource	< 0:1.22.12-5.el9_6.3 Fix: upgrade to 0:1.22.12-5.el9_6.3
Red Hat:rhel_eus:9.6::appstream	redhat	gstreamer1-plugins-good-gtk	< 0:1.22.12-5.el9_6.3 Fix: upgrade to 0:1.22.12-5.el9_6.3
Red Hat:rhel_eus:9.6::appstream	redhat	gstreamer1-plugins-good-gtk-debuginfo	< 0:1.22.12-5.el9_6.3 Fix: upgrade to 0:1.22.12-5.el9_6.3
Red Hat:rhel_eus:9.6::appstream	redhat	gstreamer1-plugins-good-qt-debuginfo	< 0:1.22.12-5.el9_6.3 Fix: upgrade to 0:1.22.12-5.el9_6.3

Original advisory text

Red Hat Security Advisory: gstreamer1-plugins-good security update

References

https://access.redhat.com/errata/RHSA-2026:68644 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2514801 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2514807 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68644.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-73433 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-73433 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-73433 Vendor Advisory
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231 Third Party Advisory
https://gstreamer.freedesktop.org/security/sa-2026-0072.html Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-73434 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-73434 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-73434 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.6 Medium

Timeline

Published18 Sep 2026

Updated18 Sep 2026

First seen18 Sep 2026

Sources

RHSA-2026:68644 · OSV

Track software like this

Free during beta