Critical Security Update for gstreamer1-plugins-ugly-free: CVE-2026-19389
Summary
RHSA-2026:67930: Red Hat Security Advisory: gstreamer1-plugins-ugly-free security update. Affects gstreamer1-plugins-ugly-free versions < 0:1.22.1-2.el9_4. Fixed in 0:1.22.1-2.el9_4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
gstreamer1-plugins-ugly-free is a collection of plugins for GStreamer, a powerful multimedia framework used for handling audio and video processing. This package includes various codecs and formats that are not included in the base GStreamer package due to licensing issues. The plugins are essential for applications that require advanced multimedia capabilities. However, vulnerabilities in these plugins can expose systems to security risks, making timely updates crucial.
Vulnerability Detail
The vulnerability identified as CVE-2026-19389 affects the gstreamer1-plugins-ugly-free package. It originates from improper handling of certain media formats, which could allow an attacker to execute arbitrary code or cause a denial of service. The potential ramifications include unauthorized access to system resources and compromise of sensitive data. This vulnerability has a CVSS score of 7.1, indicating a high severity level, particularly due to its impact on confidentiality and availability.
How To Fix
Minimum fixed version
0:1.22.1-2.el9_4
This is the first release that contains the fix.
sudo dnf update gstreamer1-plugins-ugly-freeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable the use of the affected plugins until the package is updated. This can be done by modifying the application configuration to exclude the gstreamer1-plugins-ugly-free plugins from being loaded.
Conclusion
The gstreamer1-plugins-ugly-free package is critical for multimedia processing, but it is currently affected by a significant vulnerability (CVE-2026-19389). Users are strongly advised to update to the latest patched version to safeguard their systems. Temporary workarounds are available, but they do not replace the need for a proper update.
See every vulnerability recorded for gstreamer1-plugins-ugly-free →
FAQ
CVE-2026-19389 is a security vulnerability in the gstreamer1-plugins-ugly-free package that could allow attackers to execute arbitrary code.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
If immediate updates are not possible, consider disabling the affected plugins as a temporary workaround to mitigate risks.
The vulnerability has a CVSS score of 7.1, indicating a high severity level that could impact system confidentiality and availability.
More information can be found in the Red Hat Security Advisory at https://security.access.redhat.com/data/osv/RHSA-2026:67930.json.
Related vulnerabilities
Recent vulnerabilities recorded for gstreamer1-plugins-ugly-free.
