UBUNTU-CVE-2026-61626

GHSA-5gf7-wjfm-vmvm: Out-of-bounds bit clears for negative Matroska ReadOrder values...

CVE-2026-61626

GHSA-5gf7-wjfm-vmvm: Out-of-bounds bit clears for negative Matroska ReadOrder values...

Amazon Linux 2 : gstreamer1-plugins-good, --advisory ALAS2-2026-3788 (ALAS-2026-3788)

The version of gstreamer1-plugins-good installed on the remote host is prior to 1.18.4-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3788 advisory. Heap buffer overflow in the Matroska MKV demuxer when calculating decompressed buffer sizes for...

Important: gstreamer1-plugins-good

Issue Overview: Heap buffer overflow in the Matroska MKV demuxer when calculating decompressed buffer sizes for bz2-compressed tracks. The issue occurs due to missing parentheses in the buffer size calculation, causing incorrect memory allocation and potential out-of-bounds writes. from...

Important: gstreamer1-plugins-good

Issue Overview: Heap buffer overflow in the Matroska MKV demuxer when calculating decompressed buffer sizes for bz2-compressed tracks. The issue occurs due to missing parentheses in the buffer size calculation, causing incorrect memory allocation and potential out-of-bounds writes. from...

SUSE SLES12 Security Update : gstreamer-plugins-good (SUSE-SU-2026:2727-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2727-1 advisory. This update for gstreamer-plugins-good fixes the following issues - CVE-2024-47540: uninitialized stack memory in Matroska/WebM demuxer...

Security update for gstreamer-plugins-good

This update for gstreamer-plugins-good fixes the following issues CVE-2024-47540: uninitialized stack memory in Matroska/WebM demuxer bsc1234421. CVE-2026-53705: Heap buffer overflow in WavPack decoder via integer overflow bsc1268449. Patch Instructions: To install this SUSE update use the SUSE...

SUSE-SU-2026:2727-1 Security update for gstreamer-plugins-good

This update for gstreamer-plugins-good fixes the following issues - CVE-2024-47540: uninitialized stack memory in Matroska/WebM demuxer bsc1234421. - CVE-2026-53705: Heap buffer overflow in WavPack decoder via integer overflow bsc1268449...

CVE-2026-49246

Summary: Jellyfin is vulnerable to a path traversal leading to remote code execution via crafted MKV attachment filename tags. The issue stems from unsanitized input being passed to Path.Combine(attachmentFolder, fileName) in PathManager.GetAttachmentPath, where Path.Combine does not normalise or...

PT-2026-52066

Name of the Vulnerable Software and Affected Versions Jellyfin versions prior to 10.11.10 Description Missing path sanitization during playback allows the use of a specially crafted MKV file with forged filename tags to redirect attachment extraction to any absolute path on the disk. This occurs...

SUSE CVE-2019-9719

A stack-based buffer overflow in the subtitle decoder in Libav 12.3 allows attackers to corrupt the stack via a crafted video file in Matroska format, because srttoass in libavcodec/srtdec.c misuses snprintf. NOTE: Third parties dispute that this is a vulnerability because “no evidence of a...

Astra Linux – Vulnerability in gst-plugins-good1.0

Before version 1.18.4, GStreamer might access already-freeed memory in error code paths when demuxing certain malformed Matroska files...

Astra Linux – Vulnerability in gst-plugins-good1.0

GStreamer before version 1.18.4 may cause heap corruption when parsing certain malformed Matroska files...

Unity Linux 20.1070e Security Update: gstreamer1-plugins-good (UTSA-2026-017385)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017385 advisory. Integer overflow in matroskademux element in gstmatroskademuxaddwvpkheader function which allows a heap overwrite while parsing matroska files. Potential for arbitra...

Unity Linux 20.1070e Security Update: gstreamer1-plugins-good (UTSA-2026-017384)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017384 advisory. DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in matroskaparse element in gstmatroskadecompressdata function which...

SUSE CVE-2013-3245

plugins/demux/libmkvplugin.dll in VideoLAN VLC Media Player 2.0.7, and possibly other versions, allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted MKV file, possibly involving an integer overflow and out-of-bounds read or heap-based buffer...

gstreamer1 -- multiple vulnerabilities

The GStreamer project reports multiple security vulnerabilities fixed in the 1.28.2 release: Several security vulnerabilities were addressed, including: H.264 video parser NULL pointer dereference when freeing SPS/MVC data. Integer overflows in the AV1 LEB128 parser, H.266/VVC video parser, and W...

OSV-2026-455 UNKNOWN READ in mkv::matroska_segment_c::TrackInit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=495498906 Crash type: UNKNOWN READ Crash state: mkv::matroskasegmentc::TrackInit mkv::matroskasegmentc::TrackInit mkv::matroskasegmentc::ParseTrackEntry...

MiracleLinux 8 : gstreamer1-plugins-good-1.16.1-5.el8_10 (AXSA:2024-9444:03)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-9444:03 advisory. gstreamer1-plugins-good: uninitialized stack memory in Matroska/WebM demuxer CVE-2024-47540 gstreamer1-plugins-good: OOB-write in isomp4/qtdemux.c...

MiracleLinux 8 : gstreamer1-plugins-good-1.16.1-3.el8 (AXSA:2022-4391:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-4391:01 advisory. gstreamer-plugins-good: Use-after-free in matroska demuxing CVE-2021-3497 Tenable has extracted the preceding description block directly from the MiracleLinu...