Every CVE Search/ Get API key

CVE-2026-14935

Gstreamer1-plugins-bad-free: gstreamer: webrtcbin accepts remote sdp without a=fingerprint due to inverted presence check

3.7 LowFix available

A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto() function contains an inverted boolean condition that causes it to accept remote SDP offers or answers that lack the required a=fingerprint attribute, while incorrectly rejecting those that include it. An attacker with the ability to intercept and modify WebRTC signaling messages could exploit this to bypass the SDP-level DTLS certificate fingerprint binding, weakening defenses against man-in-the-middle attacks on media streams.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.23%Up 0.1 points since Jul 8, 2026
90%50%10%1%

What each source reports

CVE List Score used 3.7

Gstreamer1-plugins-bad-free: gstreamer: webrtcbin accepts remote sdp without a=fingerprint due to inverted presence check

A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto() function contains an inverted boolean condition that causes it to accept remote SDP offers or answers that lack the required a=fingerprint attribute, while incorrectly rejecting those that include it. An attacker with the ability to intercept and modify WebRTC signaling messages could exploit this to bypass the SDP-level DTLS certificate fingerprint binding, weakening defenses against man-in-the-middle attacks on media streams.

Record
CVE-2026-14935
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-670
Updated
2026-11-06
EUVDEUVD-2026-42051 3.7

A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto() function contains an inverted boolean condition that causes it to accept remote SDP offers or answers that lack the required a=fingerprint attribute, while incorrectly rejecting those that include it. An attacker with the ability to intercept and modify WebRTC signaling messages could exploit this to bypass the SDP-level DTLS certificate fingerprint binding, weakening defenses against man-in-the-middle attacks on media streams.

Record
EUVD-2026-42051
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-06
GitHub AdvisoriesGHSA-m678-vwg3-59mp 3.7

A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto()...

A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto() function contains an inverted boolean condition that causes it to accept remote SDP offers or answers that lack the required a=fingerprint attribute, while incorrectly rejecting those that include it. An attacker with the ability to intercept and modify WebRTC signaling messages could exploit this to bypass the SDP-level DTLS certificate fingerprint binding, weakening defenses against man-in-the-middle attacks on media streams.

Record
GHSA-m678-vwg3-59mp
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-670
Updated
2026-11-02
NVD 3.7

A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto() function contains an inverted boolean condition that causes it to accept remote SDP offers or answers that lack the required a=fingerprint attribute, while incorrectly rejecting those that include it. An attacker with the ability to intercept and modify WebRTC signaling messages could exploit this to bypass the SDP-level DTLS certificate fingerprint binding, weakening defenses against man-in-the-middle attacks on media streams.

Record
CVE-2026-14935
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-670
Updated
2026-11-06
OSVDEBIAN-CVE-2026-14935 3.7

A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto() function contains an inverted boolean condition that causes it to accept remote SDP offers or answers that lack the required a=fingerprint attribute, while incorrectly rejecting those that include it. An attacker with the ability to intercept and modify WebRTC signaling messages could exploit this to bypass the SDP-level DTLS certificate fingerprint binding, weakening defenses against man-in-the-middle attacks on media streams.

Record
DEBIAN-CVE-2026-14935
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-07
OSVOESA-2026-3580 7.5

gstreamer1-plugins-bad-free security update

GStreamer is a pipeline-based multi media framework that links together a wide variety of media processing systems to complete complex workflows, based on graphs of filters which operate on media data. This package contains plug-ins that are not tested well enough yet, or the code is not of good enough quality.

Security Fix(es):

A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto() function contains an inverted boolean condition that causes it to accept remote SDP offers or answers that lack the required a=fingerprint attribute, while incorrectly rejecting those that include it. An attacker with the ability to intercept and modify WebRTC signaling messages could exploit this to bypass the SDP-level DTLS certificate fingerprint binding, weakening defenses against man-in-the-middle attacks on media streams.(CVE-2026-14935)

A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed into a fixed-size 2048-byte stack buffer without bounds checking. A remote unauthenticated attacker can send a certificate with an oversized Subject DN that exceeds the buffer, causing a stack buffer overflow and process crash, resulting in denial of service.(CVE-2026-59692)

Record
OESA-2026-3580
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVUBUNTU-CVE-2026-14935 3.7

A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto() function contains an inverted boolean condition that causes it to accept remote SDP offers or answers that lack the required a=fingerprint attribute, while incorrectly rejecting those that include it. An attacker with the ability to intercept and modify WebRTC signaling messages could exploit this to bypass the SDP-level DTLS certificate fingerprint binding, weakening defenses against man-in-the-middle attacks on media streams.

Record
UBUNTU-CVE-2026-14935
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2026:21370-1 No score

Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issues

  • CVE-2026-12891: unchecked aspect_ratio_idc value used as an array index in the H.266 parser could cause a global out- of-bounds read (bsc#1268872).
  • CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser (bsc#1268971).
  • CVE-2026-14935: webrtcbin accepts remote SDP without a=fingerprint due to inverted presence check (bsc#1271051).
  • CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write (bsc#1268406).
  • CVE-2026-52721: crafted PCAP records during IPv4 or TCP header parsing could cause an out-of-bounds read (bsc#1268408).
  • CVE-2026-52722: crafted VMnc stream with large cursor dimensions can overflow signed integer (bsc#1268410).
  • CVE-2026-53701: multi-slice-in-tile partitions without slice index bounds checks could trigger an out-of-bounds write (bsc#1268172).
  • CVE-2026-53702: incorrect loop bound during H.265 SEI message parsing could result in a stack buffer overflow (bsc#1268168).
  • CVE-2026-59692: unvalidated peer certificate Subject DN printed during a DTLS handshake could cause a stack buffer overflow (bsc#1271168).
Record
openSUSE-SU-2026:21370-1
Updated
2026-11-02
OSVSUSE-SU-2026:22752-1 No score

Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issues

  • CVE-2026-12891: unchecked aspect_ratio_idc value used as an array index in the H.266 parser could cause a global out- of-bounds read (bsc#1268872).
  • CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser (bsc#1268971).
  • CVE-2026-14935: webrtcbin accepts remote SDP without a=fingerprint due to inverted presence check (bsc#1271051).
  • CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write (bsc#1268406).
  • CVE-2026-52721: crafted PCAP records during IPv4 or TCP header parsing could cause an out-of-bounds read (bsc#1268408).
  • CVE-2026-52722: crafted VMnc stream with large cursor dimensions can overflow signed integer (bsc#1268410).
  • CVE-2026-53701: multi-slice-in-tile partitions without slice index bounds checks could trigger an out-of-bounds write (bsc#1268172).
  • CVE-2026-53702: incorrect loop bound during H.265 SEI message parsing could result in a stack buffer overflow (bsc#1268168).
  • CVE-2026-59692: unvalidated peer certificate Subject DN printed during a DTLS handshake could cause a stack buffer overflow (bsc#1271168).
Record
SUSE-SU-2026:22752-1
Updated
2026-11-02
OSVSUSE-SU-2026:22817-1 No score

Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issues

  • CVE-2026-12891: unchecked aspect_ratio_idc value used as an array index in the H.266 parser could cause a global out- of-bounds read (bsc#1268872).
  • CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser (bsc#1268971).
  • CVE-2026-14935: webrtcbin accepts remote SDP without a=fingerprint due to inverted presence check (bsc#1271051).
  • CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write (bsc#1268406).
  • CVE-2026-52721: crafted PCAP records during IPv4 or TCP header parsing could cause an out-of-bounds read (bsc#1268408).
  • CVE-2026-52722: crafted VMnc stream with large cursor dimensions can overflow signed integer (bsc#1268410).
  • CVE-2026-53701: multi-slice-in-tile partitions without slice index bounds checks could trigger an out-of-bounds write (bsc#1268172).
  • CVE-2026-53702: incorrect loop bound during H.265 SEI message parsing could result in a stack buffer overflow (bsc#1268168).
  • CVE-2026-59692: unvalidated peer certificate Subject DN printed during a DTLS handshake could cause a stack buffer overflow (bsc#1271168).
Record
SUSE-SU-2026:22817-1
Updated
2026-11-02
OSVSUSE-SU-2026:3058-1 No score

Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issues

  • CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser (bsc#1268971).
  • CVE-2026-14935: webrtcbin accepts remote SDP without a=fingerprint due to inverted presence check (bsc#1271051).
  • CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write (bsc#1268406).
  • CVE-2026-52721: crafted PCAP records during IPv4 or TCP header parsing could cause an out-of-bounds read (bsc#1268408).
  • CVE-2026-52722: crafted VMnc stream with large cursor dimensions can overflow signed integer (bsc#1268410).
  • CVE-2026-53702: incorrect loop bound during H.265 SEI message parsing could result in a stack buffer overflow (bsc#1268168).
  • CVE-2026-59692: unvalidated peer certificate Subject DN printed during a DTLS handshake could cause a stack buffer overflow (bsc#1271168).
Record
SUSE-SU-2026:3058-1
Updated
2026-11-02
OSVSUSE-SU-2026:3125-1 No score

Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issues:

  • CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser (bsc#1268971).
  • CVE-2026-14935: webrtcbin accepts remote SDP without a=fingerprint due to inverted presence check (bsc#1271051).
  • CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write (bsc#1268406).
  • CVE-2026-52721: crafted PCAP records during IPv4 or TCP header parsing could cause an out-of-bounds read (bsc#1268408).
  • CVE-2026-52722: crafted VMnc stream with large cursor dimensions can overflow signed integer (bsc#1268410).
  • CVE-2026-53702: incorrect loop bound during H.265 SEI message parsing could result in a stack buffer overflow (bsc#1268168).
  • CVE-2026-59692: unvalidated peer certificate Subject DN printed during a DTLS handshake could cause a stack buffer overflow (bsc#1271168).
Record
SUSE-SU-2026:3125-1
Updated
2026-11-02
OSVSUSE-SU-2026:3133-1 No score

Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issues

  • CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser (bsc#1268971).
  • CVE-2026-14935: webrtcbin accepts remote SDP without a=fingerprint due to inverted presence check (bsc#1271051).
  • CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write (bsc#1268406).
  • CVE-2026-52721: crafted PCAP records during IPv4 or TCP header parsing could cause an out-of-bounds read (bsc#1268408).
  • CVE-2026-52722: crafted VMnc stream with large cursor dimensions can overflow signed integer (bsc#1268410).
  • CVE-2026-53702: incorrect loop bound during H.265 SEI message parsing could result in a stack buffer overflow (bsc#1268168).
  • CVE-2026-59692: unvalidated peer certificate Subject DN printed during a DTLS handshake could cause a stack buffer overflow (bsc#1271168).
Record
SUSE-SU-2026:3133-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gst-plugins-bad1.0
Debian:12
 before 1.22.0-4+deb12u8, plus listed versions
1.22.0-41.22.0-4+deb12u11.22.0-4+deb12u21.22.0-4+deb12u31.22.0-4+deb12u41.22.0-4+deb12u51.22.0-4+deb12u61.22.0-4+deb12u7
1.22.0-4+deb12u8
gst-plugins-bad1.0
Debian:13
 All versions, plus listed versions
1.26.10-11.26.10-21.26.2-31.26.2-3+deb13u11.26.2-3+deb13u2
Show 38 moreShow less
1.26.2-3+deb13u31.26.3-11.26.4-11.26.5-11.26.5-21.26.6-11.26.6-21.26.6-31.26.6-41.26.6-51.26.7-11.26.7-21.26.8-11.26.9-11.27.1-11.27.2-11.27.50-11.27.90-11.27.90-21.27.90-31.28.0-11.28.1-11.28.1-21.28.1-31.28.2-11.28.2-21.28.3-11.28.4-11.28.5-11.28.5-21.28.6-11.28.7-11.28.7-21.28.8-11.28.9-11.29.1-11.29.2-11.29.2-2
 None known
gst-plugins-bad1.0
Debian:14
 before 1.28.5-1, plus listed versions
1.26.10-11.26.10-21.26.2-31.26.3-11.26.4-1
Show 25 moreShow less
1.26.5-11.26.5-21.26.6-11.26.6-21.26.6-31.26.6-41.26.6-51.26.7-11.26.7-21.26.8-11.26.9-11.27.1-11.27.2-11.27.50-11.27.90-11.27.90-21.27.90-31.28.0-11.28.1-11.28.1-21.28.1-31.28.2-11.28.2-21.28.3-11.28.4-1
1.28.5-1
gstreamer1-plugins-bad-free
openEuler:20.03-LTS-SP4
From an advisory covering 2 CVEs
 before 1.16.2-9.oe2003sp4
1.16.2-9.oe2003sp4
gstreamer1-plugins-bad-free
openEuler:22.03-LTS-SP4
From an advisory covering 2 CVEs
 before 1.16.2-18.oe2203sp4
1.16.2-18.oe2203sp4
gstreamer1-plugins-bad-free
openEuler:24.03-LTS-SP1
From an advisory covering 2 CVEs
 before 1.16.2-18.oe2403sp1
1.16.2-18.oe2403sp1
gstreamer1-plugins-bad-free
openEuler:24.03-LTS-SP3
From an advisory covering 2 CVEs
 before 1.16.2-18.oe2403sp3
1.16.2-18.oe2403sp3
gstreamer1-plugins-bad-free
openEuler:24.03-LTS-SP4
From an advisory covering 2 CVEs
 before 1.16.2-18.oe2403sp4
1.16.2-18.oe2403sp4
gstreamer-plugins-bad
SUSE:Linux Micro 6.2
From an advisory covering 9 CVEs
 before 1.26.7-160000.3.1
1.26.7-160000.3.1
gstreamer-plugins-bad
SUSE:Linux Enterprise Server 16.0
From an advisory covering 9 CVEs
 before 1.26.7-160000.3.1
1.26.7-160000.3.1
Show 24 moreShow less
Affected packages
PackageAffectedFixed
gstreamer-plugins-bad
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 9 CVEs
 before 1.26.7-160000.3.1
1.26.7-160000.3.1
gstreamer-plugins-bad
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 7 CVEs
 before 1.24.0-150600.4.9.1
1.24.0-150600.4.9.1
gstreamer-plugins-bad
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
From an advisory covering 7 CVEs
 before 1.24.0-150600.4.9.1
1.24.0-150600.4.9.1
gstreamer-plugins-bad
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 7 CVEs
 before 1.24.0-150600.4.9.1
1.24.0-150600.4.9.1
gstreamer-plugins-bad
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 7 CVEs
 before 1.24.0-150600.4.9.1
1.24.0-150600.4.9.1
gstreamer-plugins-bad
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 7 CVEs
 before 1.24.0-150600.4.9.1
1.24.0-150600.4.9.1
gstreamer-plugins-bad
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 7 CVEs
 before 1.22.0-150500.3.34.1
1.22.0-150500.3.34.1
gstreamer-plugins-bad
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 7 CVEs
 before 1.22.0-150500.3.34.1
1.22.0-150500.3.34.1
gstreamer-plugins-bad
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 7 CVEs
 before 1.22.0-150500.3.34.1
1.22.0-150500.3.34.1
gstreamer-plugins-bad
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 7 CVEs
 before 1.22.0-150500.3.34.1
1.22.0-150500.3.34.1
gstreamer-plugins-bad
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 7 CVEs
 before 1.20.1-150400.3.29.1
1.20.1-150400.3.29.1
gstreamer-plugins-bad
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 7 CVEs
 before 1.20.1-150400.3.29.1
1.20.1-150400.3.29.1
gstreamer-plugins-bad
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 7 CVEs
 before 1.20.1-150400.3.29.1
1.20.1-150400.3.29.1
gstreamer-plugins-bad
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 7 CVEs
 before 1.20.1-150400.3.29.1
1.20.1-150400.3.29.1
gst-plugins-bad1.0
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.2.0-3ubuntu51.2.1-1ubuntu11.2.1-1ubuntu21.2.2-1ubuntu11.2.2-1ubuntu2
Show 6 moreShow less
1.2.2-1ubuntu41.2.3-1ubuntu11.2.3-1ubuntu21.2.4-1~ubuntu11.2.4-1~ubuntu1.11.2.4-1~ubuntu1.1+esm1
 None known
gst-plugins-bad1.0
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.6.0-1ubuntu11.6.1-1ubuntu11.6.2-1ubuntu11.7.1-1ubuntu11.7.1-1ubuntu3
Show 11 moreShow less
1.7.1-1ubuntu41.7.2-1ubuntu11.7.90-1ubuntu21.7.91-1ubuntu11.8.0-1ubuntu11.8.1-1ubuntu0.11.8.2-1ubuntu0.11.8.2-1ubuntu0.21.8.3-1ubuntu0.21.8.3-1ubuntu0.2+esm11.8.3-1ubuntu0.2+esm2
 None known
gst-plugins-bad1.0
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.12.3-1ubuntu11.12.3-1ubuntu21.12.3-2ubuntu11.12.4-2ubuntu11.12.4-2ubuntu2
Show 8 moreShow less
1.13.1-1ubuntu11.13.91-1ubuntu11.14.0-1ubuntu11.14.1-1ubuntu1~ubuntu18.04.11.14.4-1ubuntu1~ubuntu18.04.11.14.5-0ubuntu1~18.04.11.14.5-0ubuntu1~18.04.1+esm11.14.5-0ubuntu1~18.04.1+esm2
 None known
gst-plugins-bad1.0
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.16.1-1ubuntu11.16.1-1ubuntu31.16.1-1ubuntu41.16.1-1ubuntu51.16.1-1ubuntu6
Show 9 moreShow less
1.16.1-1ubuntu81.16.2-1ubuntu11.16.2-1ubuntu21.16.2-2ubuntu11.16.2-2.1ubuntu11.16.3-0ubuntu11.16.3-0ubuntu1.11.16.3-0ubuntu1.1+esm11.16.3-0ubuntu1.1+esm2
 None known
gst-plugins-bad1.0
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.18.5-1ubuntu11.18.5-1ubuntu31.20.0-2ubuntu21.20.1-1ubuntu21.20.3-0ubuntu11.20.3-0ubuntu1.11.20.3-0ubuntu1.1+esm21.20.3-0ubuntu1.1+esm3
 None known
gst-plugins-bad1.0
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.22.4-1ubuntu11.22.4-1ubuntu21.22.4-1ubuntu41.22.9-2ubuntu11.24.0-1ubuntu3
Show 4 moreShow less
1.24.0-1ubuntu41.24.2-1ubuntu41.24.2-1ubuntu4+esm11.24.2-1ubuntu4+esm2
 None known
gst-plugins-bad1.0
Ubuntu:25.10
 All versions, plus listed versions
1.26.0-1ubuntu21.26.2-1ubuntu11.26.3-1ubuntu11.26.4-1ubuntu11.26.5-1ubuntu2
 None known
gst-plugins-bad1.0
Ubuntu:26.10
 All versions, plus listed versions
1.28.2-1ubuntu11.28.2-1ubuntu21.28.4-1ubuntu11.28.4-1ubuntu21.28.6-1ubuntu1
 None known
gst-plugins-bad1.0
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.26.5-1ubuntu21.27.2-1ubuntu11.27.90-1ubuntu21.28.0-1ubuntu21.28.1-2ubuntu2
Show 4 moreShow less
1.28.1-2ubuntu31.28.2-1ubuntu11.28.2-1ubuntu1.11.28.2-1ubuntu1.2
 None known
gstreamer-plugins-bad
openSUSE:Leap 16.0
From an advisory covering 9 CVEs
 before 1.26.7-160000.3.1
1.26.7-160000.3.1

History

History
RecordedChangedSources
affectedCVE List, EUVD, NVD, OSV
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-14935 is a low vulnerability (CVSS 3.7) in Red Hat Enterprise Linux 10, published July 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 14th percentile. Fixed in gst-plugins-bad1.0 1.22.0-4+deb12u8.

References

Show 28 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open