Critical Security Update for gstreamer1-plugins-bad-free: Addressing Heap and Buffer Vulnerabilities
Summary
ALSA-2026:47180: Important: gstreamer1-plugins-bad-free security update. Affects gstreamer1-plugins-bad-free versions < 1.26.7-2.el10_2.6. Fixed in 1.26.7-2.el10_2.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GStreamer is a powerful streaming media framework that allows developers to create applications that handle audio and video data. The gstreamer1-plugins-bad-free package is a collection of additional plug-ins that enhance GStreamer’s capabilities. However, recent vulnerabilities have been identified in this package, specifically affecting its handling of certain media data formats, which could lead to severe security risks.
Vulnerability Detail
The vulnerabilities identified in gstreamer1-plugins-bad-free include a heap out-of-bounds write in the rfbsrc/librfb Hextile component (CVE-2026-59691) and a stack buffer overflow in the openssl_verify_callback function related to DTLS certificate handling (CVE-2026-59692). These vulnerabilities can be exploited by attackers to execute arbitrary code, potentially leading to system compromise and unauthorized access to sensitive information.
How To Fix
Minimum fixed version
1.26.7-2.el10_2.6
This is the first release that contains the fix.
sudo dnf update gstreamer1-plugins-bad-freeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable the affected plug-ins or avoid using the functionalities that rely on the vulnerable components until the packages are updated. However, this is not a permanent solution and updating is strongly recommended.
Conclusion
In summary, the gstreamer1-plugins-bad-free package has critical vulnerabilities that require immediate attention. Users are advised to update their packages to the latest version to mitigate risks associated with these vulnerabilities. Utilizing tools like Vulert can help monitor and manage open-source vulnerabilities effectively.
See every vulnerability recorded for gstreamer1-plugins-bad-free →
FAQ
The vulnerabilities include a heap out-of-bounds write and a stack buffer overflow, which can lead to arbitrary code execution.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check your application without any signup.
Consider disabling the affected plug-ins or avoiding their use until you can apply the update.
Yes, if exploited, these vulnerabilities could lead to unauthorized access and potential data loss.
Detailed information can be found on the CVE pages for CVE-2026-59691 and CVE-2026-59692.
Related vulnerabilities
Recent vulnerabilities recorded for gstreamer1-plugins-bad-free.
