Critical Security Update for gstreamer1-plugins-bad-free: Denial of Service and Buffer Overflow Vulnerabilities
Summary
ALSA-2026:36834: Important: gstreamer1-plugins-bad-free security update. Affects gstreamer1-plugins-bad-free versions < 1.22.12-7.el9_8.1. Fixed in 1.22.12-7.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GStreamer is a powerful streaming media framework that allows developers to create applications that handle audio and video data. The gstreamer1-plugins-bad-free package includes a variety of plugins that enhance the capabilities of GStreamer. However, vulnerabilities in this package can lead to severe security issues, including denial of service and buffer overflows, which can compromise the integrity and availability of applications using these plugins.
Vulnerability Detail
The vulnerabilities identified in the gstreamer1-plugins-bad-free package include a denial of service caused by AV1 tile_list_obu parser byte/bit confusion (CVE-2026-52718), an out-of-bounds read due to JPEG segment length validation in the VA decoder (CVE-2026-52719), a heap buffer overflow triggered by crafted VNC server rectangles in librfb (CVE-2026-52720), and a signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722). These vulnerabilities can lead to application crashes, data corruption, and potential exploitation by malicious actors.
How To Fix
Minimum fixed version
1.22.12-7.el9_8.1
This is the first release that contains the fix.
sudo dnf update gstreamer1-plugins-bad-freeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you may consider disabling the affected plugins until the package can be updated. This can be done by modifying your GStreamer pipeline to exclude the use of the vulnerable plugins.
Conclusion
The gstreamer1-plugins-bad-free package has critical vulnerabilities that require immediate attention. Updating to the latest patched version is essential to protect your applications from potential exploitation. Utilize tools like Vulert to monitor your software for vulnerabilities effectively.
See every vulnerability recorded for gstreamer1-plugins-bad-free →
FAQ
It is a collection of plugins for the GStreamer multimedia framework that provides additional functionalities for handling various media formats.
The vulnerabilities can lead to application crashes, data corruption, and potential exploitation by attackers, which can compromise system security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
Consider disabling the affected plugins as a temporary workaround until you can apply the necessary updates.
For detailed information, refer to the CVE pages linked in the advisory, which provide insights into the impact and technical details of each vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for gstreamer1-plugins-bad-free.
