Critical Remote Code Execution Vulnerability in gstreamer1-plugins-good Package
Summary
ALSA-2026:59152: Important: gstreamer1-plugins-good security update. Affects gstreamer1-plugins-good versions < 1.22.12-7.el9_8.8. Fixed in 1.22.12-7.el9_8.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GStreamer is a powerful streaming media framework that allows for the manipulation and processing of multimedia data through a series of filters. The gstreamer1-plugins-good package includes a collection of high-quality, well-supported plugins that are licensed under the LGPL. These plugins are essential for various media processing tasks, making GStreamer a popular choice in multimedia applications. However, recent vulnerabilities have been identified that could potentially allow attackers to exploit these plugins and execute arbitrary code remotely.
Vulnerability Detail
The vulnerabilities in the gstreamer1-plugins-good package stem from multiple heap-based buffer overflows and a use-after-free condition. Specifically, the issues arise during the parsing of MRF and PNG files, as well as in the rtpsbcdepay component. These vulnerabilities can be exploited by an attacker to execute arbitrary code on the affected system, leading to severe security risks. The vulnerabilities are tracked under CVE-2026-18296, CVE-2026-18298, CVE-2026-18299, and CVE-2026-18295, each representing a different aspect of the underlying security flaws.
How To Fix
Minimum fixed version
1.22.12-7.el9_8.8
This is the first release that contains the fix.
sudo dnf update gstreamer1-plugins-goodTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider disabling the affected plugins temporarily until the update can be applied. This can help mitigate the risk of exploitation while you prepare to install the necessary patches.
Conclusion
The gstreamer1-plugins-good package has critical vulnerabilities that could allow remote code execution. It is essential to update to the latest patched version to secure your system. Additionally, using tools like Vulert can help you monitor for such vulnerabilities in your applications effectively.
See every vulnerability recorded for gstreamer1-plugins-good →
FAQ
It is a collection of well-supported plugins for the GStreamer multimedia framework, providing essential functionalities for media processing.
The vulnerabilities include heap-based buffer overflows and a use-after-free condition that can lead to remote code execution.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without needing to sign up.
Consider disabling the affected plugins as a temporary workaround to reduce the risk of exploitation until you can apply the updates.
Detailed information about the vulnerabilities can be found on the CVE pages referenced in the advisory, including their impact and technical details.
Related vulnerabilities
Recent vulnerabilities recorded for gstreamer1-plugins-good.
