Security Update for gstreamer1-plugins-good: Addressing Out-of-Bounds Vulnerabilities
Summary
ALSA-2026:55436: Moderate: gstreamer1-plugins-good security update. Affects gstreamer1-plugins-good versions < 1.22.12-7.el9_8.4. Fixed in 1.22.12-7.el9_8.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GStreamer is a powerful streaming media framework that allows for the manipulation and processing of multimedia data through a series of filters. The gstreamer1-plugins-good package is a collection of high-quality, well-supported plugins licensed under LGPL, designed to enhance the capabilities of GStreamer. This package is widely used in various multimedia applications, making its security critical to prevent potential exploits.
Vulnerability Detail
The gstreamer1-plugins-good package has been identified to contain two significant vulnerabilities. The first, CVE-2026-73433, involves an unsigned integer underflow in the avidemux FUJIFILM strd parsing, which can lead to out-of-bounds read/write operations. The second, CVE-2026-73434, pertains to an out-of-bounds read during the parsing of the vprp video field descriptor in avidemux. Both vulnerabilities can potentially allow attackers to exploit the application, leading to unauthorized access or data corruption.
How To Fix
Minimum fixed version
1.22.12-7.el9_8.4
This is the first release that contains the fix.
sudo dnf update gstreamer1-plugins-goodTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider disabling the affected plugins temporarily until the update can be applied. This can help mitigate the risk of exploitation while you prepare to update.
Conclusion
The gstreamer1-plugins-good package has critical vulnerabilities that require immediate attention. By updating to the latest patched version, users can protect their applications from potential exploits. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for gstreamer1-plugins-good →
FAQ
The vulnerabilities include an unsigned integer underflow and an out-of-bounds read, both of which can lead to potential exploits.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
Consider disabling the affected plugins temporarily as a workaround until you can apply the necessary updates.
This version contains the security patches that address the identified vulnerabilities, ensuring your application is protected.
For detailed information, refer to the CVE pages linked in the advisory or visit the official GStreamer documentation.
Related vulnerabilities
Recent vulnerabilities recorded for gstreamer1-plugins-good.
