gstreamer-plugins-bad: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling

🗓️ 20 Apr 2026 04:34:22Reported by RedHatType

GStreamer DVB Subtitles handling vulnerability enables remote code execution via out of bounds write caused by invalid coordinates.

Reporter	Title	Published	Views	Family All 133
FreeBSD	gstreamer1 -- multiple vulnerabilities	25 Feb 202600:00	–	freebsd
IBM Security Bulletins	Security Bulletin: IBM Optim 1.0.0, 1.1.0 and 1.2.0 impacted by vulnerabilities in webkit2gtk3-jsc 2.50.4-1.el9_7, gstreamer1-plugins-base 1.22.12-4.el9, jetty-io 11.0.24, zookeeper 3.9.3, jackson-core 2.12.7, aircompressor 2.0.2, libtiff 4.4.0-1	21 Sep 202616:56	–	ibm
IBM Security Bulletins	Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in aircompressor, libarchive, gstreamer1, LIBPNG, bind9, giflib, react-router, dompurify	28 Sep 202606:36	–	ibm
attackerkb	CVE-2026-2923	13 Mar 202620:39	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : gstreamer1-plugin-openh264, gstreamer1-plugins-bad-free, gstreamer1-plugins-bad-free-devel (ALAS2023-2026-1521)	2 Apr 202600:00	–	nessus
Tenable Nessus	AlmaLinux 10 : gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free (ALSA-2026:6259)	5 Apr 202600:00	–	nessus
Tenable Nessus	AlmaLinux 9 : gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free (ALSA-2026:6300)	5 Apr 202600:00	–	nessus
Tenable Nessus	AlmaLinux 8 : gstreamer1-plugins-bad-free, gstreamer1-plugins-base, and gstreamer1-plugins-good (ALSA-2026:6750)	10 Apr 202600:00	–	nessus
Tenable Nessus	Rocky Linux 10.1 [CIQ] Security Update: gstreamer1-plugins-bad-free / gstreamer1-plugins-bad-free-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_6259)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 10.2 [CIQ] Security Update: gstreamer1-plugins-bad-free / gstreamer1-plugins-bad-free-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_19024)	1 Oct 202600:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	9.6	aarch64	gstreamer1-plugins-bad-free	1.22.12-5.el9_6	gstreamer1-plugins-bad-free-1.22.12-5.el9_6.aarch64.rpm
Red Hat Enterprise Linux	9.6	i686	gstreamer1-plugins-bad-free	1.22.12-5.el9_6	gstreamer1-plugins-bad-free-1.22.12-5.el9_6.i686.rpm
Red Hat Enterprise Linux	9.6	ppc64le	gstreamer1-plugins-bad-free	1.22.12-5.el9_6	gstreamer1-plugins-bad-free-1.22.12-5.el9_6.ppc64le.rpm
Red Hat Enterprise Linux	9.6	s390x	gstreamer1-plugins-bad-free	1.22.12-5.el9_6	gstreamer1-plugins-bad-free-1.22.12-5.el9_6.s390x.rpm
Red Hat Enterprise Linux	9.6	x86_64	gstreamer1-plugins-bad-free	1.22.12-5.el9_6	gstreamer1-plugins-bad-free-1.22.12-5.el9_6.x86_64.rpm
Red Hat Enterprise Linux	9.6	aarch64	gstreamer1-plugins-bad-free-debuginfo	1.22.12-5.el9_6	gstreamer1-plugins-bad-free-debuginfo-1.22.12-5.el9_6.aarch64.rpm
Red Hat Enterprise Linux	9.6	i686	gstreamer1-plugins-bad-free-debuginfo	1.22.12-5.el9_6	gstreamer1-plugins-bad-free-debuginfo-1.22.12-5.el9_6.i686.rpm
Red Hat Enterprise Linux	9.6	ppc64le	gstreamer1-plugins-bad-free-debuginfo	1.22.12-5.el9_6	gstreamer1-plugins-bad-free-debuginfo-1.22.12-5.el9_6.ppc64le.rpm
Red Hat Enterprise Linux	9.6	s390x	gstreamer1-plugins-bad-free-debuginfo	1.22.12-5.el9_6	gstreamer1-plugins-bad-free-debuginfo-1.22.12-5.el9_6.s390x.rpm
Red Hat Enterprise Linux	9.6	x86_64	gstreamer1-plugins-bad-free-debuginfo	1.22.12-5.el9_6	gstreamer1-plugins-bad-free-debuginfo-1.22.12-5.el9_6.x86_64.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-2923
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
gitlab	www.gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/3b8253f447bcc9831dbf643d2c69b205fedbe086
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-2923
cve	www.cve.org/CVERecord
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-26-161/

20 Jul 2026 21:55Current

8.6High risk

Vulners AI Score8.6

CVSS 3.17.8

CVSS 37.8

EPSS0.0034

SSVC

CWE-787