Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
AlmaLinux GStreamer plugins may cause memory corruption
published 2 months ago
Summary
The GStreamer plugin packages for AlmaLinux can mishandle certain video files, which might let a program write beyond its memory limits or read invalid data. This could lead to crashes or allow an attacker to take control of the affected system. Install the latest updates for the gstreamer1-plugins-good packages as soon as they are available to fix the problem.
What to do
- Update almalinux gstreamer1-plugins-good to version 1.22.12-4.el9.tuxcare.els5.
- Update almalinux gstreamer1-plugins-good-gtk to version 1.22.12-4.el9.tuxcare.els5.
- Update almalinux gstreamer1-plugins-good-qt to version 1.22.12-4.el9.tuxcare.els5.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:AlmaLinux:9.6 | almalinux | gstreamer1-plugins-good |
< 1.22.12-4.el9.tuxcare.els5 Fix: upgrade to 1.22.12-4.el9.tuxcare.els5
|
| TuxCare:AlmaLinux:9.6 | almalinux | gstreamer1-plugins-good-gtk |
< 1.22.12-4.el9.tuxcare.els5 Fix: upgrade to 1.22.12-4.el9.tuxcare.els5
|
| TuxCare:AlmaLinux:9.6 | almalinux | gstreamer1-plugins-good-qt |
< 1.22.12-4.el9.tuxcare.els5 Fix: upgrade to 1.22.12-4.el9.tuxcare.els5
|
Original advisory text
gstreamer1-plugins-good: Fix of 4 CVEs
- CVE-2026-18295: qtmoovrecover: validate box sizes when parsing MRF recovery
files to prevent an out-of-bounds write
- CVE-2026-18296: qtmoovrecover: validate minimum atom sizes when parsing MRF
recovery files to prevent a heap buffer overflow
- CVE-2026-18298: gdkpixbufdec: handle format and resolution changes correctly
to prevent a heap buffer overflow
- CVE-2026-18299: rtpsbcdepay: check for available data in the adapter and for
a large enough payload header to prevent an out-of-bounds read and
use-after-free
files to prevent an out-of-bounds write
- CVE-2026-18296: qtmoovrecover: validate minimum atom sizes when parsing MRF
recovery files to prevent a heap buffer overflow
- CVE-2026-18298: gdkpixbufdec: handle format and resolution changes correctly
to prevent a heap buffer overflow
- CVE-2026-18299: rtpsbcdepay: check for available data in the adapter and for
a large enough payload header to prevent an out-of-bounds read and
use-after-free
References
- https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1788197463.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-18295 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-18296 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-18298 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-18299 Vendor Advisory
Timeline
Published31 Aug 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1788197463 · OSV
Track software like this
Free during beta