CVE-2026-19387
Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec ima/dvi adpcm decoder
A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. This can lead to application crash, denial of service, memory corruption, or potentially arbitrary code execution when untrusted media is processed.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec ima/dvi adpcm decoder
A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. This can lead to application crash, denial of service, memory corruption, or potentially arbitrary code execution when untrusted media is processed.
- Record
CVE-2026-19387- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2026-54986
A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. This can lead to application crash, denial of service, memory corruption, or potentially arbitrary code execution when untrusted media is processed.
- Record
EUVD-2026-54986- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-32fh-qx9x-qfwj
A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec...
A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. This can lead to application crash, denial of service, memory corruption, or potentially arbitrary code execution when untrusted media is processed.
- Record
GHSA-32fh-qx9x-qfwj- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
NVD
A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. This can lead to application crash, denial of service, memory corruption, or potentially arbitrary code execution when untrusted media is processed.
- Record
CVE-2026-19387- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-19387
A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. This can lead to application crash, denial of service, memory corruption, or potentially arbitrary code execution when untrusted media is processed.
- Record
DEBIAN-CVE-2026-19387- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVRHSA-2026:55433
Red Hat Security Advisory: gstreamer1-plugins-bad-free security update
- Record
RHSA-2026:55433- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
Show 20 moreShow less
OSVRHSA-2026:55865
Red Hat Security Advisory: gstreamer1-plugins-bad-free and gstreamer1-plugins-ugly-free security update
- Record
RHSA-2026:55865- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVRHSA-2026:56521
Red Hat Security Advisory: gstreamer1-plugins-bad-free security update
- Record
RHSA-2026:56521- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVRHSA-2026:65122
Red Hat Security Advisory: gstreamer1-plugins-bad-free security update
- Record
RHSA-2026:65122- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVRHSA-2026:65123
Red Hat Security Advisory: gstreamer1-plugins-bad-free security update
- Record
RHSA-2026:65123- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVRHSA-2026:65124
Red Hat Security Advisory: gstreamer1-plugins-bad-free security update
- Record
RHSA-2026:65124- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVRHSA-2026:66406
Red Hat Security Advisory: gstreamer1-plugins-bad-free security update
- Record
RHSA-2026:66406- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVRHSA-2026:66407
Red Hat Security Advisory: gstreamer1-plugins-bad-free security update
- Record
RHSA-2026:66407- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVRHSA-2026:67151
Red Hat Security Advisory: gstreamer1-plugins-bad-free security update
- Record
RHSA-2026:67151- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVRHSA-2026:67844
Red Hat Security Advisory: gstreamer1-plugins-bad-free security update
- Record
RHSA-2026:67844- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVRHSA-2026:67861
Red Hat Security Advisory: gstreamer1-plugins-bad-free security update
- Record
RHSA-2026:67861- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVRLSA-2026:55433
Important: gstreamer1-plugins-bad-free security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.
Security Fix(es):
- gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder (CVE-2026-19387)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:55433- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVRLSA-2026:55865
Important: gstreamer1-plugins-bad-free and gstreamer1-plugins-ugly-free security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.
Security Fix(es):
-
gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder (CVE-2026-19387)
-
gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read (CVE-2026-19389)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:55865- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVRLSA-2026:56521
Important: gstreamer1-plugins-bad-free security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.
Security Fix(es):
- gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder (CVE-2026-19387)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:56521- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-19387
A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. This can lead to application crash, denial of service, memory corruption, or potentially arbitrary code execution when untrusted media is processed.
- Record
UBUNTU-CVE-2026-19387- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVALSA-2026:55433 No score
Important: gstreamer1-plugins-bad-free security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.
Security Fix(es):
- gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder (CVE-2026-19387)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:55433- Updated
- 2026-11-02
OSVALSA-2026:55865 No score
Important: gstreamer1-plugins-bad-free and gstreamer1-plugins-ugly-free security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.
Security Fix(es):
- gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder (CVE-2026-19387)
- gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read (CVE-2026-19389)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:55865- Updated
- 2026-11-02
OSVALSA-2026:56521 No score
Important: gstreamer1-plugins-bad-free security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.
Security Fix(es):
- gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder (CVE-2026-19387)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:56521- Updated
- 2026-11-02
OSVCLSA-2026-1787237880 No score
gstreamer1-plugins-bad-free: Fix of CVE-2026-19387
- CVE-2026-19387: adpcmdec: Fix IMA ADPCM input size check to match with the actual code
- Record
CLSA-2026-1787237880- Updated
- 2026-11-02
OSVCLSA-2026-1788438390 No score
gstreamer1-plugins-bad-free: Fix of CVE-2026-19387
- CVE-2026-19387: fix out-of-bounds write in the IMA ADPCM decoder by correcting the input size check to account for the channel count, and fail negotiation when block_align is not provided
- Record
CLSA-2026-1788438390- Updated
- 2026-11-02
OSVUSN-8855-1 No score
gst-plugins-bad1.0 vulnerability
It was discovered that GStreamer Bad Plugins incorrectly validated the size of multi-channel audio blocks. An attacker could possibly use this issue with a specially crafted WAV file to cause the program to crash, resulting in a denial of service, or possibly execute arbitrary code.
- Record
USN-8855-1- Updated
- 2026-11-02
Affected products
- red hat enterprise linux 10
- red hat enterprise linux 10.0 extended update support
- red hat enterprise linux 7 extended lifecycle support
- red hat enterprise linux 8
- red hat enterprise linux 8.4 advanced mission critical update support
- red hat enterprise linux 8.4 extended update support long-life add-on
- red hat enterprise linux 8.6 advanced mission critical update support
- red hat enterprise linux 8.6 extended update support long-life add-on
- red hat enterprise linux 8.8 telecommunications update service
- red hat enterprise linux 8.8 update services for sap solutions
- red hat enterprise linux 9
- red hat enterprise linux 9.2 update services for sap solutions
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gstreamer1-plugins-bad-freeAlmaLinux:10 |
before 1.26.7-2.el10_2.7 | 1.26.7-2.el10_2.7 |
gstreamer1-plugins-bad-free-develAlmaLinux:10 |
before 1.26.7-2.el10_2.7 | 1.26.7-2.el10_2.7 |
gstreamer1-plugins-bad-free-libsAlmaLinux:10 |
before 1.26.7-2.el10_2.7 | 1.26.7-2.el10_2.7 |
gstreamer1-plugins-bad-freeAlmaLinux:9 From an advisory covering 2 CVEs |
before 1.22.12-7.el9_8.4 | 1.22.12-7.el9_8.4 |
gstreamer1-plugins-bad-free-develAlmaLinux:9 From an advisory covering 2 CVEs |
before 1.22.12-7.el9_8.4 | 1.22.12-7.el9_8.4 |
gstreamer1-plugins-bad-free-libsAlmaLinux:9 From an advisory covering 2 CVEs |
before 1.22.12-7.el9_8.4 | 1.22.12-7.el9_8.4 |
gstreamer1-plugins-ugly-freeAlmaLinux:9 From an advisory covering 2 CVEs |
before 1.22.12-6.el9_8.2 | 1.22.12-6.el9_8.2 |
gstreamer1-plugins-bad-freeAlmaLinux:8 |
before 1.16.1-9.el8_10.2 | 1.16.1-9.el8_10.2 |
gstreamer1-plugins-bad-free-develAlmaLinux:8 |
before 1.16.1-9.el8_10.2 | 1.16.1-9.el8_10.2 |
gstreamer1-plugins-bad-freeTuxCare:AlmaLinux:9.6 |
before 1.22.12-4.el9_6.tuxcare.els3 | 1.22.12-4.el9_6.tuxcare.els3 |
Show 85 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gstreamer1-plugins-bad-free-develTuxCare:AlmaLinux:9.6 |
before 1.22.12-4.el9_6.tuxcare.els3 | 1.22.12-4.el9_6.tuxcare.els3 |
gstreamer1-plugins-bad-free-libsTuxCare:AlmaLinux:9.6 |
before 1.22.12-4.el9_6.tuxcare.els3 | 1.22.12-4.el9_6.tuxcare.els3 |
gstreamer1-plugins-bad-freeTuxCare:AlmaLinux:9.2 |
before 1.18.4-6.el9_2.tuxcare.els8 | 1.18.4-6.el9_2.tuxcare.els8 |
gstreamer1-plugins-bad-free-develTuxCare:AlmaLinux:9.2 |
before 1.18.4-6.el9_2.tuxcare.els8 | 1.18.4-6.el9_2.tuxcare.els8 |
gst-plugins-bad1.0Debian:12 |
before 1.22.0-4+deb12u8, plus listed versions 1.22.0-41.22.0-4+deb12u11.22.0-4+deb12u21.22.0-4+deb12u31.22.0-4+deb12u41.22.0-4+deb12u51.22.0-4+deb12u61.22.0-4+deb12u7 |
1.22.0-4+deb12u8 |
gst-plugins-bad1.0Debian:13 |
before 1.26.2-3+deb13u3, plus listed versions 1.26.2-31.26.2-3+deb13u11.26.2-3+deb13u2 |
1.26.2-3+deb13u3 |
gst-plugins-bad1.0Debian:14 |
before 1.28.6-1, plus listed versions 1.26.10-11.26.10-21.26.2-31.26.3-11.26.4-1 Show 27 moreShow less1.26.5-11.26.5-21.26.6-11.26.6-21.26.6-31.26.6-41.26.6-51.26.7-11.26.7-21.26.8-11.26.9-11.27.1-11.27.2-11.27.50-11.27.90-11.27.90-21.27.90-31.28.0-11.28.1-11.28.1-21.28.1-31.28.2-11.28.2-21.28.3-11.28.4-11.28.5-11.28.5-2 |
1.28.6-1 |
gstreamer1-plugins-bad-freeRed Hat:enterprise_linux:10.2 |
before 0:1.26.7-2.el10_2.7 | 0:1.26.7-2.el10_2.7 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:enterprise_linux:10.2 |
before 0:1.26.7-2.el10_2.7 | 0:1.26.7-2.el10_2.7 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:enterprise_linux:10.2 |
before 0:1.26.7-2.el10_2.7 | 0:1.26.7-2.el10_2.7 |
gstreamer1-plugins-bad-free-libsRed Hat:enterprise_linux:10.2 |
before 0:1.26.7-2.el10_2.7 | 0:1.26.7-2.el10_2.7 |
gstreamer1-plugins-bad-free-libs-debuginfoRed Hat:enterprise_linux:10.2 |
before 0:1.26.7-2.el10_2.7 | 0:1.26.7-2.el10_2.7 |
gstreamer1-plugins-bad-free-develRed Hat:enterprise_linux:10.2 |
before 0:1.26.7-2.el10_2.7 | 0:1.26.7-2.el10_2.7 |
gstreamer1-plugins-bad-freeRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.22.12-7.el9_8.4 | 0:1.22.12-7.el9_8.4 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.22.12-7.el9_8.4 | 0:1.22.12-7.el9_8.4 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.22.12-7.el9_8.4 | 0:1.22.12-7.el9_8.4 |
gstreamer1-plugins-bad-free-libsRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.22.12-7.el9_8.4 | 0:1.22.12-7.el9_8.4 |
gstreamer1-plugins-bad-free-libs-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.22.12-7.el9_8.4 | 0:1.22.12-7.el9_8.4 |
gstreamer1-plugins-ugly-freeRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.22.12-6.el9_8.2 | 0:1.22.12-6.el9_8.2 |
gstreamer1-plugins-ugly-free-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.22.12-6.el9_8.2 | 0:1.22.12-6.el9_8.2 |
gstreamer1-plugins-ugly-free-debugsourceRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.22.12-6.el9_8.2 | 0:1.22.12-6.el9_8.2 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:enterprise_linux:9::crb From an advisory covering 2 CVEs |
before 0:1.22.12-7.el9_8.4 | 0:1.22.12-7.el9_8.4 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:enterprise_linux:9::crb From an advisory covering 2 CVEs |
before 0:1.22.12-7.el9_8.4 | 0:1.22.12-7.el9_8.4 |
gstreamer1-plugins-bad-free-develRed Hat:enterprise_linux:9::crb From an advisory covering 2 CVEs |
before 0:1.22.12-7.el9_8.4 | 0:1.22.12-7.el9_8.4 |
gstreamer1-plugins-bad-free-libs-debuginfoRed Hat:enterprise_linux:9::crb From an advisory covering 2 CVEs |
before 0:1.22.12-7.el9_8.4 | 0:1.22.12-7.el9_8.4 |
gstreamer1-plugins-bad-freeRed Hat:enterprise_linux:8::appstream |
before 0:1.16.1-9.el8_10.2 | 0:1.16.1-9.el8_10.2 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:1.16.1-9.el8_10.2 | 0:1.16.1-9.el8_10.2 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:1.16.1-9.el8_10.2 | 0:1.16.1-9.el8_10.2 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:enterprise_linux:8::crb |
before 0:1.16.1-9.el8_10.2 | 0:1.16.1-9.el8_10.2 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:enterprise_linux:8::crb |
before 0:1.16.1-9.el8_10.2 | 0:1.16.1-9.el8_10.2 |
gstreamer1-plugins-bad-free-develRed Hat:enterprise_linux:8::crb |
before 0:1.16.1-9.el8_10.2 | 0:1.16.1-9.el8_10.2 |
gstreamer1-plugins-bad-freeRed Hat:rhel_e4s:9.2::appstream |
before 0:1.18.4-9.el9_2.6 | 0:1.18.4-9.el9_2.6 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:rhel_e4s:9.2::appstream |
before 0:1.18.4-9.el9_2.6 | 0:1.18.4-9.el9_2.6 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:rhel_e4s:9.2::appstream |
before 0:1.18.4-9.el9_2.6 | 0:1.18.4-9.el9_2.6 |
gstreamer1-plugins-bad-freeRed Hat:enterprise_linux_eus:10.0 |
before 0:1.24.11-3.el10_0.7 | 0:1.24.11-3.el10_0.7 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:enterprise_linux_eus:10.0 |
before 0:1.24.11-3.el10_0.7 | 0:1.24.11-3.el10_0.7 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:enterprise_linux_eus:10.0 |
before 0:1.24.11-3.el10_0.7 | 0:1.24.11-3.el10_0.7 |
gstreamer1-plugins-bad-free-libsRed Hat:enterprise_linux_eus:10.0 |
before 0:1.24.11-3.el10_0.7 | 0:1.24.11-3.el10_0.7 |
gstreamer1-plugins-bad-free-libs-debuginfoRed Hat:enterprise_linux_eus:10.0 |
before 0:1.24.11-3.el10_0.7 | 0:1.24.11-3.el10_0.7 |
gstreamer1-plugins-bad-free-develRed Hat:enterprise_linux_eus:10.0 |
before 0:1.24.11-3.el10_0.7 | 0:1.24.11-3.el10_0.7 |
gstreamer1-plugins-bad-freeRed Hat:rhel_eus:9.6::appstream |
before 0:1.22.12-5.el9_6.7 | 0:1.22.12-5.el9_6.7 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:rhel_eus:9.6::appstream |
before 0:1.22.12-5.el9_6.7 | 0:1.22.12-5.el9_6.7 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:rhel_eus:9.6::appstream |
before 0:1.22.12-5.el9_6.7 | 0:1.22.12-5.el9_6.7 |
gstreamer1-plugins-bad-free-libsRed Hat:rhel_eus:9.6::appstream |
before 0:1.22.12-5.el9_6.7 | 0:1.22.12-5.el9_6.7 |
gstreamer1-plugins-bad-free-libs-debuginfoRed Hat:rhel_eus:9.6::appstream |
before 0:1.22.12-5.el9_6.7 | 0:1.22.12-5.el9_6.7 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:rhel_eus:9.6::crb |
before 0:1.22.12-5.el9_6.7 | 0:1.22.12-5.el9_6.7 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:rhel_eus:9.6::crb |
before 0:1.22.12-5.el9_6.7 | 0:1.22.12-5.el9_6.7 |
gstreamer1-plugins-bad-free-develRed Hat:rhel_eus:9.6::crb |
before 0:1.22.12-5.el9_6.7 | 0:1.22.12-5.el9_6.7 |
gstreamer1-plugins-bad-free-libs-debuginfoRed Hat:rhel_eus:9.6::crb |
before 0:1.22.12-5.el9_6.7 | 0:1.22.12-5.el9_6.7 |
gstreamer1-plugins-bad-freeRed Hat:rhel_aus:8.6::appstream |
before 0:1.16.1-4.el8_6.5 | 0:1.16.1-4.el8_6.5 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:rhel_aus:8.6::appstream |
before 0:1.16.1-4.el8_6.5 | 0:1.16.1-4.el8_6.5 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:rhel_aus:8.6::appstream |
before 0:1.16.1-4.el8_6.5 | 0:1.16.1-4.el8_6.5 |
gstreamer1-plugins-bad-freeRed Hat:rhel_eus_long_life:8.6::appstream |
before 0:1.16.1-4.el8_6.5 | 0:1.16.1-4.el8_6.5 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:rhel_eus_long_life:8.6::appstream |
before 0:1.16.1-4.el8_6.5 | 0:1.16.1-4.el8_6.5 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:rhel_eus_long_life:8.6::appstream |
before 0:1.16.1-4.el8_6.5 | 0:1.16.1-4.el8_6.5 |
gstreamer1-plugins-bad-freeRed Hat:rhel_e4s:9.4::appstream |
before 0:1.22.1-6.el9_4.7 | 0:1.22.1-6.el9_4.7 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:rhel_e4s:9.4::appstream |
before 0:1.22.1-6.el9_4.7 | 0:1.22.1-6.el9_4.7 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:rhel_e4s:9.4::appstream |
before 0:1.22.1-6.el9_4.7 | 0:1.22.1-6.el9_4.7 |
gstreamer1-plugins-bad-freeRed Hat:rhel_e4s:8.8::appstream |
before 0:1.16.1-4.el8_8.5 | 0:1.16.1-4.el8_8.5 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:rhel_e4s:8.8::appstream |
before 0:1.16.1-4.el8_8.5 | 0:1.16.1-4.el8_8.5 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:rhel_e4s:8.8::appstream |
before 0:1.16.1-4.el8_8.5 | 0:1.16.1-4.el8_8.5 |
gstreamer1-plugins-bad-freeRed Hat:rhel_tus:8.8::appstream |
before 0:1.16.1-4.el8_8.5 | 0:1.16.1-4.el8_8.5 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:rhel_tus:8.8::appstream |
before 0:1.16.1-4.el8_8.5 | 0:1.16.1-4.el8_8.5 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:rhel_tus:8.8::appstream |
before 0:1.16.1-4.el8_8.5 | 0:1.16.1-4.el8_8.5 |
gstreamer1-plugins-bad-freeRed Hat:rhel_aus:8.4::appstream |
before 0:1.16.1-4.el8_4.5 | 0:1.16.1-4.el8_4.5 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:rhel_aus:8.4::appstream |
before 0:1.16.1-4.el8_4.5 | 0:1.16.1-4.el8_4.5 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:rhel_aus:8.4::appstream |
before 0:1.16.1-4.el8_4.5 | 0:1.16.1-4.el8_4.5 |
gstreamer1-plugins-bad-freeRed Hat:rhel_eus_long_life:8.4::appstream |
before 0:1.16.1-4.el8_4.5 | 0:1.16.1-4.el8_4.5 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:rhel_eus_long_life:8.4::appstream |
before 0:1.16.1-4.el8_4.5 | 0:1.16.1-4.el8_4.5 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:rhel_eus_long_life:8.4::appstream |
before 0:1.16.1-4.el8_4.5 | 0:1.16.1-4.el8_4.5 |
gstreamer1-plugins-bad-freeRed Hat:rhel_els:7 |
before 0:1.10.4-8.el7_9 | 0:1.10.4-8.el7_9 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:rhel_els:7 |
before 0:1.10.4-8.el7_9 | 0:1.10.4-8.el7_9 |
gstreamer1-plugins-bad-free-develRed Hat:rhel_els:7 |
before 0:1.10.4-8.el7_9 | 0:1.10.4-8.el7_9 |
gstreamer1-plugins-bad-free-gtkRed Hat:rhel_els:7 |
before 0:1.10.4-8.el7_9 | 0:1.10.4-8.el7_9 |
gstreamer1-plugins-bad-freeRocky Linux:10 |
before 0:1.26.7-2.el10_2.7 | 0:1.26.7-2.el10_2.7 |
gstreamer1-plugins-bad-freeRocky Linux:9 From an advisory covering 2 CVEs |
before 0:1.22.12-7.el9_8.4 | 0:1.22.12-7.el9_8.4 |
gstreamer1-plugins-ugly-freeRocky Linux:9 From an advisory covering 2 CVEs |
before 0:1.22.12-6.el9_8.2 | 0:1.22.12-6.el9_8.2 |
gstreamer1-plugins-bad-freeRocky Linux:8 |
before 0:1.16.1-9.el8_10.2 | 0:1.16.1-9.el8_10.2 |
gst-plugins-bad1.0Ubuntu:Pro:14.04:LTS |
before 1.2.4-1~ubuntu1.1+esm1, plus listed versions 1.2.0-3ubuntu51.2.1-1ubuntu11.2.1-1ubuntu21.2.2-1ubuntu11.2.2-1ubuntu2 Show 5 moreShow less1.2.2-1ubuntu41.2.3-1ubuntu11.2.3-1ubuntu21.2.4-1~ubuntu11.2.4-1~ubuntu1.1 |
1.2.4-1~ubuntu1.1+esm1 |
gst-plugins-bad1.0Ubuntu:Pro:16.04:LTS |
before 1.8.3-1ubuntu0.2+esm2, plus listed versions 1.6.0-1ubuntu11.6.1-1ubuntu11.6.2-1ubuntu11.7.1-1ubuntu11.7.1-1ubuntu3 Show 10 moreShow less1.7.1-1ubuntu41.7.2-1ubuntu11.7.90-1ubuntu21.7.91-1ubuntu11.8.0-1ubuntu11.8.1-1ubuntu0.11.8.2-1ubuntu0.11.8.2-1ubuntu0.21.8.3-1ubuntu0.21.8.3-1ubuntu0.2+esm1 |
1.8.3-1ubuntu0.2+esm2 |
gst-plugins-bad1.0Ubuntu:Pro:18.04:LTS |
before 1.14.5-0ubuntu1~18.04.1+esm2, plus listed versions 1.12.3-1ubuntu11.12.3-1ubuntu21.12.3-2ubuntu11.12.4-2ubuntu11.12.4-2ubuntu2 Show 7 moreShow less1.13.1-1ubuntu11.13.91-1ubuntu11.14.0-1ubuntu11.14.1-1ubuntu1~ubuntu18.04.11.14.4-1ubuntu1~ubuntu18.04.11.14.5-0ubuntu1~18.04.11.14.5-0ubuntu1~18.04.1+esm1 |
1.14.5-0ubuntu1~18.04.1+esm2 |
gst-plugins-bad1.0Ubuntu:Pro:20.04:LTS |
before 1.16.3-0ubuntu1.1+esm2, plus listed versions 1.16.1-1ubuntu11.16.1-1ubuntu31.16.1-1ubuntu41.16.1-1ubuntu51.16.1-1ubuntu6 Show 8 moreShow less1.16.1-1ubuntu81.16.2-1ubuntu11.16.2-1ubuntu21.16.2-2ubuntu11.16.2-2.1ubuntu11.16.3-0ubuntu11.16.3-0ubuntu1.11.16.3-0ubuntu1.1+esm1 |
1.16.3-0ubuntu1.1+esm2 |
gst-plugins-bad1.0Ubuntu:Pro:22.04:LTS |
before 1.20.3-0ubuntu1.1+esm3, plus listed versions 1.18.5-1ubuntu11.18.5-1ubuntu31.20.0-2ubuntu21.20.1-1ubuntu21.20.3-0ubuntu11.20.3-0ubuntu1.11.20.3-0ubuntu1.1+esm2 |
1.20.3-0ubuntu1.1+esm3 |
gst-plugins-bad1.0Ubuntu:Pro:24.04:LTS |
before 1.24.2-1ubuntu4+esm2, plus listed versions 1.22.4-1ubuntu11.22.4-1ubuntu21.22.4-1ubuntu41.22.9-2ubuntu11.24.0-1ubuntu31.24.0-1ubuntu41.24.2-1ubuntu41.24.2-1ubuntu4+esm1 |
1.24.2-1ubuntu4+esm2 |
gst-plugins-bad1.0Ubuntu:26.04:LTS |
before 1.28.2-1ubuntu1.2, plus listed versions 1.26.5-1ubuntu21.27.2-1ubuntu11.27.90-1ubuntu21.28.0-1ubuntu21.28.1-2ubuntu21.28.1-2ubuntu31.28.2-1ubuntu11.28.2-1ubuntu1.1 |
1.28.2-1ubuntu1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-19387 is a high vulnerability (CVSS 7.6) in Red Hat Enterprise Linux 10, published August 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in gstreamer1-plugins-bad-free 1.26.7-2.el10_2.7.
References
access.redhat.com/errata/RHSA-2026:55433
Show 43 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2513015
gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12235
gstreamer.freedesktop.org/releases/1.28
nvd.nist.gov/vuln/detail/CVE-2026-19387
github.com/advisories/GHSA-32fh-qx9x-qfwj
errata.almalinux.org/10/ALSA-2026-55433.html
errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1787237880.html
security-tracker.debian.org/tracker/CVE-2026-19387
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55433.json
cve.org/CVERecord?id=CVE-2026-19387
errata.rockylinux.org/RLSA-2026:55433
ubuntu.com/security/CVE-2026-19387