Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
gstreamer1-plugins-bad-free: Denial of Service and Data Exposure
published 4 months ago
Summary
An update is available to fix several security issues in the gstreamer1-plugins-bad-free package. These issues could allow an attacker to crash a system or access sensitive data. It's recommended to update your system to the latest version of gstreamer1-plugins-bad-free to ensure your system remains secure.
What to do
- Update almalinux gstreamer1-plugins-bad-free to version 1.26.7-2.el10_2.4.
- Update almalinux gstreamer1-plugins-bad-free-devel to version 1.26.7-2.el10_2.4.
- Update almalinux gstreamer1-plugins-bad-free-libs to version 1.26.7-2.el10_2.4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:10 | almalinux | gstreamer1-plugins-bad-free |
< 1.26.7-2.el10_2.4 Fix: upgrade to 1.26.7-2.el10_2.4
|
| AlmaLinux:10 | almalinux | gstreamer1-plugins-bad-free-devel |
< 1.26.7-2.el10_2.4 Fix: upgrade to 1.26.7-2.el10_2.4
|
| AlmaLinux:10 | almalinux | gstreamer1-plugins-bad-free-libs |
< 1.26.7-2.el10_2.4 Fix: upgrade to 1.26.7-2.el10_2.4
|
Original advisory text
Important: gstreamer1-plugins-bad-free security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.
Security Fix(es):
* gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion (CVE-2026-52718)
* gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder (CVE-2026-52719)
* gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720)
* gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion (CVE-2026-52718)
* gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder (CVE-2026-52719)
* gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720)
* gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:36749 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-52718 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-52719 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-52720 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-52722 Third Party Advisory
- https://bugzilla.redhat.com/2486328 Third Party Advisory
- https://bugzilla.redhat.com/2486353 Third Party Advisory
- https://bugzilla.redhat.com/2486731 Third Party Advisory
- https://bugzilla.redhat.com/2486733 Third Party Advisory
- https://errata.almalinux.org/10/ALSA-2026-36749.html Vendor Advisory
Timeline
Published8 Jul 2026
Updated9 Jul 2026
First seen9 Jul 2026
Sources
ALSA-2026:36749 · OSV
Track software like this
Free during beta