Critical Security Update for gstreamer1-plugins-good: Heap Buffer Overflow Vulnerability
Summary
ALSA-2026:36675: Important: gstreamer1-plugins-good security update. Affects gstreamer1-plugins-good versions < 1.26.7-2.el10_2.1. Fixed in 1.26.7-2.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
GStreamer is a powerful streaming media framework that allows developers to create applications that handle multimedia content. The gstreamer1-plugins-good package includes a collection of high-quality, well-supported plugins that operate under the LGPL license. This package is essential for various media processing tasks, but it has been found to contain a significant security vulnerability that could potentially compromise the integrity of applications relying on it.
Vulnerability Detail
The vulnerability, identified as CVE-2026-53705, is a heap buffer overflow in the WavPack decoder caused by an integer overflow. This flaw can lead to memory corruption, which may allow an attacker to execute arbitrary code or crash the application. The vulnerability arises from improper handling of input data, making it critical for users of the affected package to address it promptly to prevent exploitation.
How To Fix
Minimum fixed version
1.26.7-2.el10_2.1
This is the first release that contains the fix.
sudo dnf update gstreamer1-plugins-goodTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the WavPack decoder in their applications until the package is updated. However, this may limit functionality depending on the use case.
Conclusion
The gstreamer1-plugins-good package has a critical vulnerability that needs immediate attention. Users are advised to update to the latest patched version to mitigate risks associated with this security flaw. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for gstreamer1-plugins-good →
FAQ
CVE-2026-53705 is a security vulnerability in the gstreamer1-plugins-good package that allows for a heap buffer overflow due to an integer overflow in the WavPack decoder.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failing to address this vulnerability could lead to memory corruption, allowing attackers to execute arbitrary code or crash your application, posing significant security risks.
Yes, a patch is available. Users should update to version 1.26.7-2.el10_2.1 of the gstreamer1-plugins-good and gstreamer1-plugins-good-gtk packages.
Vulert is a service that monitors and alerts users to open-source vulnerabilities in software using a manifest file like package-lock.json. It provides real-time alerts without requiring code access or installation.
Related vulnerabilities
Recent vulnerabilities recorded for gstreamer1-plugins-good.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
