RHSA-2026:36834: gstreamer1-plugins-bad-free update fixing CVE-2026-52718/52719/52720/52722

RHSA-2026:36834 - Security Advisory Vulnerability Overview Key Information: Security update for gstreamer1-plugins-bad-free Security Advisory: Important Red Hat Lightspeed Patch Analysis: Systems affected by this advisory have been identified and patched. Impact Scope Topic: Update for gstreamer1-plugins-bad-free applicable to Red Hat Enterprise Linux 9. Description: GStreamer is a graph-based streaming framework used for handling media data. The gstreamer1-plugins-bad-free package contains a set of plugins for GStreamer. Security Fixes: - gstreamer1-plugins-bad-free: GStreamer: Denial of Service due to byte/bit confusion in the AV1 tile_list_obs parser (CVE-2026-52718) - gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read due to bypassing JPEG segment length validation in the VA decoder (CVE-2026-52719) - gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow due to crafted VNC server rectangles in libVNC (CVE-2026-52720) - gstreamer1-plugins-bad-free: GStreamer: Payload processing due to signed image overflow in the VMc decoder (CVE-2026-52722) Remediation Affected Products: - Red Hat Enterprise Linux for x86_64, x86_64 - Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64 - Red Hat Enterprise Linux for IBM z Systems 9.390x - Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 s390x - Red Hat Enterprise Linux for Power, little endian 9.ppc64le - Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le - Red Hat Enterprise Linux for ARM 64 9.aarch64 - Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64 - Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le - Red Hat Enterprise Linux for s390_64 - Update Services for SAP Solutions 9.8 s390_64 - Red Hat CodeReady Linux Builder for x86_64 9.8 x86_64 - Red Hat CodeReady Linux Builder for Power, little endian 9.ppc64le - Red Hat CodeReady Linux Builder for ARM 64 9.aarch64 - Red Hat CodeReady Linux Builder for IBM z Systems 9.390x - Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.8 x86_64 - Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.8 ppc64le - Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.8 s390x - Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.8 aarch64 - Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64 - Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8 s390x - Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64 - Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64 - Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le - Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8 s390x Remediation Measures: - CVE-2026-52718: gstreamer1-plugins-bad-free: GStreamer: Denial of Service due to byte/bit confusion in the AV1 tile_list_obs parser - CVE-2026-52719: gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read due to bypassing JPEG segment length validation in the VA decoder - CVE-2026-52720: gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow due to crafted VNC server rectangles in libVNC - CVE-2026-52722: gstreamer1-plugins-bad-free: GStreamer: Payload processing due to signed image overflow in the VMc decoder Specific Fix Packages: - Red Hat Enterprise Linux for x86_64: - gstreamer1-plugins-bad-free-1.22.12-7.el9_8.1.src.rpm - gstreamer1-plugins-bad-free-1.22.12-7.el9_8.1.i686.rpm - gstreamer1-plugins-bad-free-debuginfo-1.22.12-7.el9_8.1.i686.rpm - gstreamer1-plugins-bad-free-debuginfo-1.22.12-7.el9_8.1.i686_64.rpm - gstreamer1-plugins-bad-free-debugsource-1.22.12-7.el9_8.1.i686.rpm - gstreamer1-plugins-bad-free-libs-1.22.12-7.el9_8.1.i686_64.rpm - gstreamer1-plugins-bad-free-libs-debuginfo-1.22.12-7.el9_8.1.i686_64.rpm - Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8: - gstreamer1-plugins-bad-free-1.22.12-7.el9_8.1.src.rpm - gstreamer1-plugins-bad-free-1.22.12-7.el9_8.1.i686.rpm - gstreamer1-plugins-bad-free-debuginfo-1.22.12-7.el9_8.1.i686.rpm - gstreamer1-plugins-bad-free-debuginfo-1.22.12-7.el9_8.1.i686_64.rpm - gstreamer1-plugins-bad-free-debugsource-1.22.12-7.el9_8.1.i686.rpm - gstreamer1-plugins-bad-free-libs-1.22.12-7.el9_8.1.i686_64.rpm - gstreamer1-plugins-bad-free-libs-debuginfo-1.22.12-7.el9_8.1.i686_64.rpm - Red Hat Enterprise Linux for IBM z Systems 9: - gstreamer1-plugins-bad-free-1.22.12-7.el9_8.1.src.rpm - gstreamer1-plugins-bad-free-debuginfo-1.22.12-7.el9_8.1.s390x.rpm - gstreamer1-plugins-bad-free-debugsource-1.22.12-7.el9_8.1.s390x.rpm - gstreamer1-plugins-bad-free-libs-1.22.12-7.el9_8.1.s390x.rpm - gstreamer1-plugins-bad-free-libs-debuginfo-1.22.12-7.el9_8.1.s390x.rpm - Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8: - gstreamer1-plugins-bad-free-1.22.12-7.el9_8.1.src.rpm - gstreamer1-plugins-bad-free-

Goal Reached Thanks to every supporter — we hit 100%!

RHSA-2026:36834: gstreamer1-plugins-bad-free update fixing CVE-2026-52718/52719/52720/52722

More from this source