Critical Security Update for gstreamer1-plugins-bad-free: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:36749: Important: gstreamer1-plugins-bad-free security update. Affects gstreamer1-plugins-bad-free versions < 1.26.7-2.el10_2.4. Fixed in 1.26.7-2.el10_2.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GStreamer is a powerful streaming media framework that allows for the manipulation and playback of audio and video data through a series of filters. The gstreamer1-plugins-bad-free package is a collection of additional plugins that enhance GStreamer’s capabilities. However, this package has been found to contain several vulnerabilities that can lead to severe security issues, including denial of service and memory corruption.
Vulnerability Detail
The vulnerabilities identified in the gstreamer1-plugins-bad-free package include a denial of service due to AV1 tile_list_obu parser byte/bit confusion, an out-of-bounds read in the VA decoder, a heap buffer overflow from crafted VNC server rectangles, and a signed integer overflow in VMnc decoder cursor payload handling. These vulnerabilities can be exploited by attackers to crash applications, read sensitive memory locations, or execute arbitrary code, posing significant risks to system integrity and user data.
How To Fix
Minimum fixed version
1.26.7-2.el10_2.4
This is the first release that contains the fix.
sudo dnf update gstreamer1-plugins-bad-freeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider disabling the affected plugins temporarily until the update can be applied. This can be done by modifying the GStreamer configuration files to exclude the vulnerable plugins.
Conclusion
In summary, the gstreamer1-plugins-bad-free package has critical vulnerabilities that require immediate attention. Updating to the latest patched version is essential to safeguard your system against potential exploits. Regular monitoring and updates are crucial for maintaining security in open-source software.
See every vulnerability recorded for gstreamer1-plugins-bad-free →
FAQ
The main vulnerabilities include denial of service, out-of-bounds reads, heap buffer overflow, and signed integer overflow.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include application crashes, unauthorized access to sensitive information, and potential execution of arbitrary code.
Yes, you can temporarily disable the affected plugins in your GStreamer configuration until an update can be applied.
It is recommended to check for updates regularly, ideally weekly, to ensure that all security vulnerabilities are addressed promptly.
Related vulnerabilities
Recent vulnerabilities recorded for gstreamer1-plugins-bad-free.
