{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright © Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for gstreamer1-plugins-good is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.\n\nSecurity Fix(es):\n\n* gst-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders (CVE-2026-18649)\n\n* gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write (CVE-2026-73433)\n\n* gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing (CVE-2026-73434)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2026:70584", "url": "https://access.redhat.com/errata/RHSA-2026:70584" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "2510614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510614" }, { "category": "external", "summary": "2514801", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514801" }, { "category": "external", "summary": "2514807", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514807" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70584.json" } ], "title": "Red Hat Security Advisory: gstreamer1-plugins-good security update", "tracking": { "current_release_date": "2026-09-23T15:06:24+00:00", "generator": { "date": "2026-09-23T15:06:24+00:00", "engine": { "name": "Red Hat SDEngine", "version": "5.4.0" } }, "id": "RHSA-2026:70584", "initial_release_date": "2026-09-23T07:05:46+00:00", "revision_history": [ { "date": "2026-09-23T07:05:46+00:00", "number": "1", "summary": "Initial version" }, { "date": "2026-09-23T07:05:46+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2026-09-23T15:06:24+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream AUS (v.8.6)", "product": { "name": "Red Hat Enterprise Linux AppStream AUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.AUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_aus:8.6::appstream" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)", "product": { "name": "Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_eus_long_life:8.6::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.src", "product": { "name": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.src", "product_id": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/gstreamer1-plugins-good@1.16.1-4.el8_6.3?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.i686", "product": { "name": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.i686", "product_id": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/gstreamer1-plugins-good@1.16.1-4.el8_6.3?arch=i686" } } }, { "category": "product_version", "name": "gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.i686", "product": { "name": "gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.i686", "product_id": "gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-gtk@1.16.1-4.el8_6.3?arch=i686" } } }, { "category": "product_version", "name": "gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.i686", "product": { "name": "gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.i686", "product_id": "gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-debugsource@1.16.1-4.el8_6.3?arch=i686" } } }, { "category": "product_version", "name": "gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.i686", "product": { "name": "gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.i686", "product_id": "gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-debuginfo@1.16.1-4.el8_6.3?arch=i686" } } }, { "category": "product_version", "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.i686", "product": { "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.i686", "product_id": "gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-gtk-debuginfo@1.16.1-4.el8_6.3?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.x86_64", "product": { "name": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.x86_64", "product_id": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/gstreamer1-plugins-good@1.16.1-4.el8_6.3?arch=x86_64" } } }, { "category": "product_version", "name": "gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.x86_64", "product": { "name": "gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.x86_64", "product_id": "gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-gtk@1.16.1-4.el8_6.3?arch=x86_64" } } }, { "category": "product_version", "name": "gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.x86_64", "product": { "name": "gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.x86_64", "product_id": "gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-debugsource@1.16.1-4.el8_6.3?arch=x86_64" } } }, { "category": "product_version", "name": "gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "product": { "name": "gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "product_id": "gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-debuginfo@1.16.1-4.el8_6.3?arch=x86_64" } } }, { "category": "product_version", "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "product": { "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "product_id": "gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-gtk-debuginfo@1.16.1-4.el8_6.3?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.aarch64", "product": { "name": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.aarch64", "product_id": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/gstreamer1-plugins-good@1.16.1-4.el8_6.3?arch=aarch64" } } }, { "category": "product_version", "name": "gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.aarch64", "product": { "name": "gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.aarch64", "product_id": "gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-gtk@1.16.1-4.el8_6.3?arch=aarch64" } } }, { "category": "product_version", "name": "gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.aarch64", "product": { "name": "gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.aarch64", "product_id": "gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-debugsource@1.16.1-4.el8_6.3?arch=aarch64" } } }, { "category": "product_version", "name": "gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.aarch64", "product": { "name": "gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.aarch64", "product_id": "gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-debuginfo@1.16.1-4.el8_6.3?arch=aarch64" } } }, { "category": "product_version", "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.aarch64", "product": { "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.aarch64", "product_id": "gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-gtk-debuginfo@1.16.1-4.el8_6.3?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.ppc64le", "product": { "name": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.ppc64le", "product_id": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/gstreamer1-plugins-good@1.16.1-4.el8_6.3?arch=ppc64le" } } }, { "category": "product_version", "name": "gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.ppc64le", "product": { "name": "gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.ppc64le", "product_id": "gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-gtk@1.16.1-4.el8_6.3?arch=ppc64le" } } }, { "category": "product_version", "name": "gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.ppc64le", "product": { "name": "gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.ppc64le", "product_id": "gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-debugsource@1.16.1-4.el8_6.3?arch=ppc64le" } } }, { "category": "product_version", "name": "gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.ppc64le", "product": { "name": "gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.ppc64le", "product_id": "gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-debuginfo@1.16.1-4.el8_6.3?arch=ppc64le" } } }, { "category": "product_version", "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.ppc64le", "product": { "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.ppc64le", "product_id": "gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-gtk-debuginfo@1.16.1-4.el8_6.3?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.s390x", "product": { "name": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.s390x", "product_id": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/gstreamer1-plugins-good@1.16.1-4.el8_6.3?arch=s390x" } } }, { "category": "product_version", "name": "gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.s390x", "product": { "name": "gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.s390x", "product_id": "gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-gtk@1.16.1-4.el8_6.3?arch=s390x" } } }, { "category": "product_version", "name": "gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.s390x", "product": { "name": "gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.s390x", "product_id": "gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-debugsource@1.16.1-4.el8_6.3?arch=s390x" } } }, { "category": "product_version", "name": "gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.s390x", "product": { "name": "gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.s390x", "product_id": "gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-debuginfo@1.16.1-4.el8_6.3?arch=s390x" } } }, { "category": "product_version", "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.s390x", "product": { "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.s390x", "product_id": "gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-gtk-debuginfo@1.16.1-4.el8_6.3?arch=s390x" } } } ], "category": "architecture", "name": "s390x" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.i686" }, "product_reference": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.i686", "relates_to_product_reference": "AppStream-8.6.0.Z.AUS" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.src as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.src" }, "product_reference": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.src", "relates_to_product_reference": "AppStream-8.6.0.Z.AUS" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.x86_64" }, "product_reference": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.AUS" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.i686" }, "product_reference": "gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.i686", "relates_to_product_reference": "AppStream-8.6.0.Z.AUS" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.x86_64" }, "product_reference": "gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.AUS" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.i686" }, "product_reference": "gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.i686", "relates_to_product_reference": "AppStream-8.6.0.Z.AUS" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.x86_64" }, "product_reference": "gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.AUS" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.i686" }, "product_reference": "gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.i686", "relates_to_product_reference": "AppStream-8.6.0.Z.AUS" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.x86_64" }, "product_reference": "gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.AUS" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.i686" }, "product_reference": "gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.i686", "relates_to_product_reference": "AppStream-8.6.0.Z.AUS" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.x86_64" }, "product_reference": "gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.AUS" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.aarch64" }, "product_reference": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.i686" }, "product_reference": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.i686", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.ppc64le" }, "product_reference": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.s390x as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.s390x" }, "product_reference": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.src as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.src" }, "product_reference": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.src", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.x86_64" }, "product_reference": "gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.aarch64" }, "product_reference": "gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.i686" }, "product_reference": "gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.i686", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.ppc64le" }, "product_reference": "gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.s390x as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.s390x" }, "product_reference": "gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.x86_64" }, "product_reference": "gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.aarch64" }, "product_reference": "gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.i686" }, "product_reference": "gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.i686", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.ppc64le" }, "product_reference": "gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.s390x as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.s390x" }, "product_reference": "gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.x86_64" }, "product_reference": "gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.aarch64" }, "product_reference": "gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.i686" }, "product_reference": "gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.i686", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.ppc64le" }, "product_reference": "gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.s390x as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.s390x" }, "product_reference": "gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.x86_64" }, "product_reference": "gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.aarch64" }, "product_reference": "gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.i686" }, "product_reference": "gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.i686", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.ppc64le" }, "product_reference": "gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.s390x as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.s390x" }, "product_reference": "gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION" }, { "category": "default_component_of", "full_product_name": { "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.x86_64" }, "product_reference": "gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Yehia Ali Mohamed Ezzat" ], "organization": "github: 0xSemizzz" } ], "cve": "CVE-2026-18649", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2026-07-31T15:39:42+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2510614" } ], "notes": [ { "category": "description", "text": "A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacker can send a continuous stream of RTP fragments without ever transmitting an end-of-fragment marker, causing the reassembly buffer to grow without bound until process memory is exhausted. This results in a denial of service through process termination.", "title": "Vulnerability description" }, { "category": "summary", "text": "gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders", "title": "Vulnerability summary" }, { "category": "other", "text": "The gstreamer1-plugins-good package ships the rtph264depay and rtph265depay elements in multiple products including Fedora and RHEL. The vulnerability is exploitable when these depayloaders process RTP from untrusted sources without an authentication layer. In deployments using SRTP (via srtpdec) or DTLS-SRTP (via WebRTC/webrtcbin), unauthenticated packets are rejected before reaching the depayloaders, which significantly reduces the attack surface. However, pipelines receiving raw unauthenticated RTP over UDP (e.g. udpsrc directly feeding rtph264depay) are fully exposed. The practical impact depends on whether the deployment uses authenticated RTP transport. Desktop media playback from local files is not affected.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.src", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.src", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-18649" }, { "category": "external", "summary": "RHBZ#2510614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510614" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-18649", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18649" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18649", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18649" }, { "category": "external", "summary": "https://0xsemizzz.vercel.app/projects/cve-2026-18649-gstreamer-rtp-dos/", "url": "https://0xsemizzz.vercel.app/projects/cve-2026-18649-gstreamer-rtp-dos/" }, { "category": "external", "summary": "https://github.com/0xSemizzz/CVE-2026-18649", "url": "https://github.com/0xSemizzz/CVE-2026-18649" }, { "category": "external", "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/113", "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/113" } ], "release_date": "2026-08-06T06:41:36.036000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-23T07:05:46+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.src", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.src", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70584" }, { "category": "workaround", "details": "The following mitigations can reduce risk before a patch is available:\n\n1. Use SRTP or DTLS-SRTP: Deploy the srtpdec element in the pipeline before the depayloader. SRTP provides per-packet authentication and will reject unauthenticated fragments before they reach rtph264depay/rtph265depay, completely preventing exploitation.\n\n2. Network-level restriction: Use firewall rules (iptables/nftables) to restrict which sources can send RTP traffic to the GStreamer process. Allow RTP only from trusted, authenticated peers.\n\n3. Build-time exclusion: Disable the entire RTP plugin by configuring with \"-Drtp=disabled\" in meson build options. This removes all RTP functionality including the vulnerable depayloaders.\n\n4. Runtime element exclusion: Prevent the affected elements from being auto-plugged by setting GST_PLUGIN_FEATURE_RANK=rtph264depay:0,rtph265depay:0. This prevents automatic selection but not explicit pipeline construction.", "product_ids": [ "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.src", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.src", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.src", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.src", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders" }, { "acknowledgments": [ { "names": [ "Seonwook Kim" ] } ], "cve": "CVE-2026-73433", "cwe": { "id": "CWE-191", "name": "Integer Underflow (Wrap or Wraparound)" }, "discovery_date": "2026-08-12T15:57:36.499000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2514801" } ], "notes": [ { "category": "description", "text": "A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets (98 and 10 bytes) without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 bytes, the counter underflows to a very large unsigned value, causing subsequent null-terminated string scanning to read far beyond the allocated heap buffer. Date-format normalization may also write beyond the buffer end. Confirmed impacts include heap out-of-bounds read, out-of-bounds write, heap information disclosure (adjacent data appearing in parsed metadata), and application crash/denial of service. The avidemux element is auto-plugged by playbin, decodebin, and gst-discoverer, so opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).", "title": "Vulnerability description" }, { "category": "summary", "text": "gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.src", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.src", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-73433" }, { "category": "external", "summary": "RHBZ#2514801", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514801" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73433", "url": "https://www.cve.org/CVERecord?id=CVE-2026-73433" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73433", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73433" }, { "category": "external", "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231", "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231" }, { "category": "external", "summary": "https://gstreamer.freedesktop.org/security/sa-2026-0072.html", "url": "https://gstreamer.freedesktop.org/security/sa-2026-0072.html" } ], "release_date": "2026-08-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-23T07:05:46+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.src", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.src", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70584" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.src", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.src", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write" }, { "acknowledgments": [ { "names": [ "Seonwook Kim" ] } ], "cve": "CVE-2026-73434", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2026-08-12T16:20:06.270000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2514807" } ], "notes": [ { "category": "description", "text": "A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).", "title": "Vulnerability description" }, { "category": "summary", "text": "gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.src", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.src", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-73434" }, { "category": "external", "summary": "RHBZ#2514807", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514807" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73434", "url": "https://www.cve.org/CVERecord?id=CVE-2026-73434" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73434", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73434" }, { "category": "external", "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231", "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231" }, { "category": "external", "summary": "https://gstreamer.freedesktop.org/security/sa-2026-0072.html", "url": "https://gstreamer.freedesktop.org/security/sa-2026-0072.html" } ], "release_date": "2026-08-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-23T07:05:46+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.src", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.src", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70584" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.src", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.AUS:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.src", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debuginfo-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-debugsource-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-0:1.16.1-4.el8_6.3.x86_64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.aarch64", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.i686", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.ppc64le", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.s390x", "AppStream-8.6.0.Z.EUS.EXTENSION:gstreamer1-plugins-good-gtk-debuginfo-0:1.16.1-4.el8_6.3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing" } ] }