Critical Security Update for gstreamer1-plugins-bad-free: Addressing Heap and Buffer Vulnerabilities
Summary
ALSA-2026:47179: Important: gstreamer1-plugins-bad-free security update. Affects gstreamer1-plugins-bad-free versions < 1.22.12-7.el9_8.3. Fixed in 1.22.12-7.el9_8.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GStreamer is a powerful streaming media framework that allows for the manipulation and processing of multimedia data through a series of filters. The gstreamer1-plugins-bad-free package is a collection of additional plug-ins that enhance GStreamer's capabilities. However, recent vulnerabilities have been identified in this package, specifically affecting the rfbsrc/librfb component and the DTLS certificate handling, which could lead to severe security risks.
Vulnerability Detail
The vulnerabilities identified in gstreamer1-plugins-bad-free include a heap out-of-bounds write in the rfbsrc/librfb component (CVE-2026-59691) and a stack buffer overflow in the openssl_verify_callback function related to DTLS certificate handling (CVE-2026-59692). These vulnerabilities can be exploited by attackers to execute arbitrary code or cause a denial of service, potentially compromising the integrity and availability of systems utilizing this package.
How To Fix
Minimum fixed version
1.22.12-7.el9_8.3
This is the first release that contains the fix.
sudo dnf update gstreamer1-plugins-bad-freeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable the affected components or refrain from using the functionalities that rely on rfbsrc/librfb and DTLS certificate verification until the package is updated. However, this is not a permanent solution and should be followed by an update as soon as possible.
Conclusion
The vulnerabilities in gstreamer1-plugins-bad-free pose significant risks to systems utilizing this package. It is crucial to update to the latest patched version to mitigate these risks. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert for ongoing security.
See every vulnerability recorded for gstreamer1-plugins-bad-free →
FAQ
The main vulnerabilities include a heap out-of-bounds write and a stack buffer overflow, which can lead to arbitrary code execution and denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider disabling the affected components as a temporary workaround.
More information can be found on the CVE pages for CVE-2026-59691 and CVE-2026-59692.
Vulert monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json, providing real-time insights without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for gstreamer1-plugins-bad-free.
