Moderate Vulnerability in gstreamer1-plugins-ugly-free: Out-of-Bounds Read Issues
Summary
ALSA-2026:36674: Moderate: gstreamer1-plugins-ugly-free security update. Affects gstreamer1-plugins-ugly-free versions < 1.22.12-6.el9_8.1. Fixed in 1.22.12-6.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GStreamer is a powerful streaming media framework that allows developers to create applications that handle media data through a series of interconnected elements. The gstreamer1-plugins-ugly-free package contains plugins that are not fully compatible with the LGPL license, which may limit their use in certain applications. This package is essential for handling various media formats, but it has recently been identified as having vulnerabilities that could be exploited.
Vulnerability Detail
The vulnerabilities identified in gstreamer1-plugins-ugly-free are related to out-of-bounds read errors in the RealMedia demuxer. Specifically, these issues occur in the audio stream header parser and the FILEINFO metadata parser. If exploited, these vulnerabilities could allow an attacker to read sensitive data from memory, potentially leading to information disclosure or application crashes. The vulnerabilities are tracked under CVE-2026-53703 and CVE-2026-53704.
How To Fix
Minimum fixed version
1.22.12-6.el9_8.1
This is the first release that contains the fix.
sudo dnf update gstreamer1-plugins-ugly-freeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider disabling the use of the affected plugins until the package can be updated. This can be done by modifying your application's configuration to exclude gstreamer1-plugins-ugly-free from the media processing pipeline.
Conclusion
The gstreamer1-plugins-ugly-free package has been identified with moderate vulnerabilities that could lead to serious security issues if left unaddressed. It is crucial to update to the latest patched version to mitigate these risks. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for gstreamer1-plugins-ugly-free →
FAQ
It is a package that contains GStreamer plugins which are not fully compatible with the LGPL license, used for handling various media formats.
Out-of-bounds read vulnerabilities occur when a program reads data outside the allocated memory buffer, which can lead to information disclosure or crashes.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
If you cannot update the package, consider disabling the affected plugins as a temporary workaround until you can apply the necessary updates.
More information can be found on the CVE pages for CVE-2026-53703 and CVE-2026-53704, which detail the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for gstreamer1-plugins-ugly-free.
