RLSA-2026:99129 Important: gstreamer1 security update

The gstreamer1 packages contain a streaming media framework, based on graphs of filters which operate on media data. Security Fixes: gstreamer: gstreamer: Use-after-free in GStreamer core buffer value deserialization CVE-2026-125704 For more details about the security issues, including the impact...

RLSA-2026:99228 Important: gstreamer1 security update

The gstreamer1 packages contain a streaming media framework, based on graphs of filters which operate on media data. Security Fixes: gstreamer: gstreamer: Use-after-free in GStreamer core buffer value deserialization CVE-2026-125704 For more details about the security issues, including the impact...

RLSA-2026:99090 Important: gstreamer1 security update

The gstreamer1 packages contain a streaming media framework, based on graphs of filters which operate on media data. Security Fixes: gstreamer: gstreamer: Use-after-free in GStreamer core buffer value deserialization CVE-2026-125704 For more details about the security issues, including the impact...

CVE-2026-18649

CVE-2026-18649 - GStreamer rtph264depay Unbounded Memory Growth DoS Proof of concept for a resource exhaustion vulnerability in GStreamer's H.264 RTP depayloader rtph264depay. The same pattern also affects rtph265depay. What it is During H.264 FU-A fragmented RTP reassembly, each incoming fragmen...

gstreamer: gstreamer: Use-after-free in GStreamer core buffer value deserialization

A use-after-free flaw was found in GStreamer core buffer value deserialization. When serialized buffer text contains an invalid character, an error path frees a mapped buffer before unmapping it. Applications that parse untrusted caps or structure data can reach a freed-buffer read and may crash....

CVE-2026-125703

A flaw was found in the GStreamer gst-plugins-bad MXF plugin. Insufficient bounds checks when parsing crafted VANC data can cause an out-of-bounds read in the demuxer, while an incorrect buffer size calculation when muxing multiple ancillary packets can cause an out-of-bounds write. Processing...

UBUNTU-CVE-2026-125707

A flaw was found in GStreamer's MXF demuxer. When an application processes a crafted MXF file, an off-by-one bounds check can allow a one-byte write past the logical end of a temporal offset array. This may corrupt memory and cause the application to crash. The extent of the impact has not been...

CVE-2026-119610

A flaw was found in GStreamer's gst-plugins-good, specifically in the H.264 RTP depayloader element. When processing MTAP16 or MTAP24 multi-time aggregation RTP packets, a signed/unsigned integer conversion error causes the remaining-length counter to underflow to a large positive value when the...

Medium: gstreamer-plugins-base

Issue Overview: A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing the application to crash when a user opens or plays media with a malformed MicroDVD .sub subtitle file...

CVE-2026-125704

A use-after-free flaw was found in GStreamer core buffer value deserialization. When serialized buffer text contains an invalid character, an error path frees a mapped buffer before unmapping it. Applications that parse untrusted caps or structure data can reach a freed-buffer read and may crash....

UBUNTU-CVE-2026-125704

A use-after-free flaw was found in GStreamer core buffer value deserialization. When serialized buffer text contains an invalid character, an error path frees a mapped buffer before unmapping it. Applications that parse untrusted caps or structure data can reach a freed-buffer read and may crash....

UBUNTU-CVE-2026-125706

A flaw was found in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin. The PES header parsers do not adequately check remaining data before reading timestamps and optional header fields. Opening a specially crafted MPEG Program Stream file can cause an...

CVE-2026-121601

A flaw was found in GStreamer's MXF demuxer plugin gst-plugins-bad. When processing a specially crafted MXF media file, the demuxer indexes its internal delta-entry and slice-offset tables using values from the file without validating that they are within the bounds of the allocated arrays. A loc...

UBUNTU-CVE-2026-125712

A flaw was found in GStreamer's gst-plugins-base RTCP SDES packet parser. A remote sender able to reach an active media session can supply a malformed SDES entry whose declared length exceeds the received packet. Missing bounds validation can cause the receiver to read beyond the packet buffer,...

CVE-2026-121629

A flaw was found in GStreamer's adaptive streaming demuxers HLS, DASH, MSS. When processing a media playlist or manifest, URIs referenced in the manifest content are fetched without restricting which URI schemes are permitted. An attacker who controls a manifest URL, or who can inject content int...

CVE-2026-125707

A flaw was found in GStreamer's MXF demuxer. When an application processes a crafted MXF file, an off-by-one bounds check can allow a one-byte write past the logical end of a temporal offset array. This may corrupt memory and cause the application to crash. The extent of the impact has not been...

CVE-2026-125712

A flaw was found in GStreamer's gst-plugins-base RTCP SDES packet parser. A remote sender able to reach an active media session can supply a malformed SDES entry whose declared length exceeds the received packet. Missing bounds validation can cause the receiver to read beyond the packet buffer,...

CVE-2026-125703

A flaw was found in the GStreamer gst-plugins-bad MXF plugin. Insufficient bounds checks when parsing crafted VANC data can cause an out-of-bounds read in the demuxer, while an incorrect buffer size calculation when muxing multiple ancillary packets can cause an out-of-bounds write. Processing...

CVE-2026-125706

A flaw was found in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin. The PES header parsers do not adequately check remaining data before reading timestamps and optional header fields. Opening a specially crafted MPEG Program Stream file can cause an...

CVE-2026-121611

A flaw was found in GStreamer's gst-plugins-bad package. A use of uninitialized memory vulnerability exists in the H.265 HEVC bitstream parser when processing Video Parameter Sets that declare more than one HRD Hypothetical Reference Decoder parameter set. A remote attacker could exploit this by...