CVE-2026-19389
Gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read
Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation of attacker-controlled length and size values can bypass bounds checks and cause out-of-bounds heap reads. This can result in application crash, denial of service, or limited information disclosure when untrusted media is processed.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read
Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation of attacker-controlled length and size values can bypass bounds checks and cause out-of-bounds heap reads. This can result in application crash, denial of service, or limited information disclosure when untrusted media is processed.
- Record
CVE-2026-19389- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-04
EUVDEUVD-2026-54987
Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation of attacker-controlled length and size values can bypass bounds checks and cause out-of-bounds heap reads. This can result in application crash, denial of service, or limited information disclosure when untrusted media is processed.
- Record
EUVD-2026-54987- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-04
GitHub AdvisoriesGHSA-p44h-f9j6-g9ff
Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins...
Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation of attacker-controlled length and size values can bypass bounds checks and cause out-of-bounds heap reads. This can result in application crash, denial of service, or limited information disclosure when untrusted media is processed.
- Record
GHSA-p44h-f9j6-g9ff- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
NVD
Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation of attacker-controlled length and size values can bypass bounds checks and cause out-of-bounds heap reads. This can result in application crash, denial of service, or limited information disclosure when untrusted media is processed.
- Record
CVE-2026-19389- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-19389
Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation of attacker-controlled length and size values can bypass bounds checks and cause out-of-bounds heap reads. This can result in application crash, denial of service, or limited information disclosure when untrusted media is processed.
- Record
DEBIAN-CVE-2026-19389- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-05
OSVRHSA-2026:55435
Red Hat Security Advisory: gstreamer1-plugins-ugly-free security update
- Record
RHSA-2026:55435- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
Show 12 moreShow less
OSVRHSA-2026:55865
Red Hat Security Advisory: gstreamer1-plugins-bad-free and gstreamer1-plugins-ugly-free security update
- Record
RHSA-2026:55865- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVRHSA-2026:67882
Red Hat Security Advisory: gstreamer1-plugins-ugly-free security update
- Record
RHSA-2026:67882- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:67883
Red Hat Security Advisory: gstreamer1-plugins-ugly-free security update
- Record
RHSA-2026:67883- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:67930
Red Hat Security Advisory: gstreamer1-plugins-ugly-free security update
- Record
RHSA-2026:67930- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:67931
Red Hat Security Advisory: gstreamer1-plugins-ugly-free security update
- Record
RHSA-2026:67931- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
OSVRLSA-2026:55435
Important: gstreamer1-plugins-ugly-free security update
GStreamer is a streaming media framework, based on graphs of elements which operate on media data. This package contains plug-ins whose license is not fully compatible with LGPL.
Security Fix(es):
- gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read (CVE-2026-19389)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:55435- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
OSVRLSA-2026:55865
Important: gstreamer1-plugins-bad-free and gstreamer1-plugins-ugly-free security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.
Security Fix(es):
-
gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder (CVE-2026-19387)
-
gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read (CVE-2026-19389)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:55865- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-19389
Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation of attacker-controlled length and size values can bypass bounds checks and cause out-of-bounds heap reads. This can result in application crash, denial of service, or limited information disclosure when untrusted media is processed.
- Record
UBUNTU-CVE-2026-19389- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
OSVALSA-2026:55435 No score
Important: gstreamer1-plugins-ugly-free security update
GStreamer is a streaming media framework, based on graphs of elements which operate on media data. This package contains plug-ins whose license is not fully compatible with LGPL.
Security Fix(es):
- gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read (CVE-2026-19389)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:55435- Updated
- 2026-11-02
OSVALSA-2026:55865 No score
Important: gstreamer1-plugins-bad-free and gstreamer1-plugins-ugly-free security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.
Security Fix(es):
- gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder (CVE-2026-19387)
- gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read (CVE-2026-19389)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:55865- Updated
- 2026-11-02
OSVCLSA-2026-1787309460 No score
gstreamer1-plugins-ugly-free: Fix of CVE-2026-19389
- CVE-2026-19389: asfdemux: Avoid integer overflows during bounds checks
- Record
CLSA-2026-1787309460- Updated
- 2026-11-02
OSVUSN-8896-1 No score
gst-plugins-ugly1.0 vulnerabilities
Michael Randrianantenaina discovered that GStreamer's Ugly Plugins incorrectly handled certain malformed RealMedia files. If a user were tricked into opening a crafted media file, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-38103, CVE-2023-38104)
It was discovered that GStreamer's Ugly Plugins incorrectly handled certain malformed ASF and RealMedia files. If a user were tricked into opening a crafted media file, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-2920, CVE-2026-2922)
Tianshuo Han discovered that GStreamer's Ugly Plugins incorrectly handled certain malformed RealMedia files. If a user were tricked into opening a crafted media file, an attacker could possibly use this issue to cause a denial of service or expose sensitive information. (CVE-2026-53703, CVE-2026-53704)
Seonwook Kim discovered that GStreamer's Ugly Plugins incorrectly handled certain malformed ASF files. If a user were tricked into opening a crafted media file, an attacker could possibly use this issue to cause a denial of service or expose sensitive information. (CVE-2026-19389)
- Record
USN-8896-1- Updated
- 2026-11-02
Affected products
- red hat enterprise linux 10
- red hat enterprise linux 10.0 extended update support
- red hat enterprise linux 7
- red hat enterprise linux 8
- red hat enterprise linux 9
- red hat enterprise linux 9.2 update services for sap solutions
- red hat enterprise linux 9.4 update services for sap solutions
- red hat enterprise linux 9.6 extended update support
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gstreamer1-plugins-ugly-freeAlmaLinux:10 |
before 1.26.7-2.el10_2.2 | 1.26.7-2.el10_2.2 |
gstreamer1-plugins-bad-freeAlmaLinux:9 From an advisory covering 2 CVEs |
before 1.22.12-7.el9_8.4 | 1.22.12-7.el9_8.4 |
gstreamer1-plugins-bad-free-develAlmaLinux:9 From an advisory covering 2 CVEs |
before 1.22.12-7.el9_8.4 | 1.22.12-7.el9_8.4 |
gstreamer1-plugins-bad-free-libsAlmaLinux:9 From an advisory covering 2 CVEs |
before 1.22.12-7.el9_8.4 | 1.22.12-7.el9_8.4 |
gstreamer1-plugins-ugly-freeAlmaLinux:9 From an advisory covering 2 CVEs |
before 1.22.12-6.el9_8.2 | 1.22.12-6.el9_8.2 |
gstreamer1-plugins-ugly-freeTuxCare:AlmaLinux:9.6 |
before 1.22.12-3.el9_6.tuxcare.els3 | 1.22.12-3.el9_6.tuxcare.els3 |
gst-plugins-ugly1.0Debian:12 |
All versions, plus listed versions 1.22.0-21.22.0-2+deb12u11.22.0-2+deb12u21.22.1-11.22.10-1 Show 45 moreShow less1.22.3-11.22.3-21.22.4-11.22.5-11.22.6-11.22.7-11.22.8-11.22.9-11.23.1-11.23.2-11.23.90-11.24.0-11.24.1-11.24.10-11.24.11-11.24.12-11.24.2-11.24.3-11.24.4-11.24.5-11.24.6-11.24.7-11.24.8-11.24.9-11.25.1-11.25.50-11.25.50-21.25.90-11.25.90-21.26.0-11.26.1-11.26.10-11.26.2-11.26.3-11.26.3-21.26.3-31.26.3-41.26.4-11.26.5-11.26.5-21.26.6-11.26.7-11.26.8-11.26.9-11.27.1-1 |
None known |
gst-plugins-ugly1.0Debian:13 |
All versions, plus listed versions 1.26.10-11.26.3-41.26.3-4+deb13u11.26.4-11.26.5-1 Show 21 moreShow less1.26.5-21.26.6-11.26.7-11.26.8-11.26.9-11.27.1-11.27.2-11.27.50-11.27.50-21.27.90-11.28.0-11.28.1-11.28.2-11.28.3-11.28.4-11.28.5-11.28.6-11.28.7-11.28.8-11.29.1-11.29.2-1 |
None known |
gst-plugins-ugly1.0Debian:14 |
before 1.28.6-1, plus listed versions 1.26.10-11.26.3-41.26.4-11.26.5-11.26.5-2 Show 15 moreShow less1.26.6-11.26.7-11.26.8-11.26.9-11.27.1-11.27.2-11.27.50-11.27.50-21.27.90-11.28.0-11.28.1-11.28.2-11.28.3-11.28.4-11.28.5-1 |
1.28.6-1 |
gstreamer1-plugins-ugly-freeRed Hat:enterprise_linux:10.2 |
before 0:1.26.7-2.el10_2.2 | 0:1.26.7-2.el10_2.2 |
Show 41 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gstreamer1-plugins-ugly-free-debuginfoRed Hat:enterprise_linux:10.2 |
before 0:1.26.7-2.el10_2.2 | 0:1.26.7-2.el10_2.2 |
gstreamer1-plugins-ugly-free-debugsourceRed Hat:enterprise_linux:10.2 |
before 0:1.26.7-2.el10_2.2 | 0:1.26.7-2.el10_2.2 |
gstreamer1-plugins-bad-freeRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.22.12-7.el9_8.4 | 0:1.22.12-7.el9_8.4 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.22.12-7.el9_8.4 | 0:1.22.12-7.el9_8.4 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.22.12-7.el9_8.4 | 0:1.22.12-7.el9_8.4 |
gstreamer1-plugins-bad-free-libsRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.22.12-7.el9_8.4 | 0:1.22.12-7.el9_8.4 |
gstreamer1-plugins-bad-free-libs-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.22.12-7.el9_8.4 | 0:1.22.12-7.el9_8.4 |
gstreamer1-plugins-ugly-freeRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.22.12-6.el9_8.2 | 0:1.22.12-6.el9_8.2 |
gstreamer1-plugins-ugly-free-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.22.12-6.el9_8.2 | 0:1.22.12-6.el9_8.2 |
gstreamer1-plugins-ugly-free-debugsourceRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.22.12-6.el9_8.2 | 0:1.22.12-6.el9_8.2 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:enterprise_linux:9::crb From an advisory covering 2 CVEs |
before 0:1.22.12-7.el9_8.4 | 0:1.22.12-7.el9_8.4 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:enterprise_linux:9::crb From an advisory covering 2 CVEs |
before 0:1.22.12-7.el9_8.4 | 0:1.22.12-7.el9_8.4 |
gstreamer1-plugins-bad-free-develRed Hat:enterprise_linux:9::crb From an advisory covering 2 CVEs |
before 0:1.22.12-7.el9_8.4 | 0:1.22.12-7.el9_8.4 |
gstreamer1-plugins-bad-free-libs-debuginfoRed Hat:enterprise_linux:9::crb From an advisory covering 2 CVEs |
before 0:1.22.12-7.el9_8.4 | 0:1.22.12-7.el9_8.4 |
gstreamer1-plugins-ugly-freeRed Hat:rhel_eus:9.6::appstream |
before 0:1.22.12-4.el9_6.2 | 0:1.22.12-4.el9_6.2 |
gstreamer1-plugins-ugly-free-debuginfoRed Hat:rhel_eus:9.6::appstream |
before 0:1.22.12-4.el9_6.2 | 0:1.22.12-4.el9_6.2 |
gstreamer1-plugins-ugly-free-debugsourceRed Hat:rhel_eus:9.6::appstream |
before 0:1.22.12-4.el9_6.2 | 0:1.22.12-4.el9_6.2 |
gstreamer1-plugins-ugly-freeRed Hat:enterprise_linux_eus:10.0 |
before 0:1.24.11-1.el10_0.3 | 0:1.24.11-1.el10_0.3 |
gstreamer1-plugins-ugly-free-debuginfoRed Hat:enterprise_linux_eus:10.0 |
before 0:1.24.11-1.el10_0.3 | 0:1.24.11-1.el10_0.3 |
gstreamer1-plugins-ugly-free-debugsourceRed Hat:enterprise_linux_eus:10.0 |
before 0:1.24.11-1.el10_0.3 | 0:1.24.11-1.el10_0.3 |
gstreamer1-plugins-ugly-freeRed Hat:rhel_e4s:9.4::appstream |
before 0:1.22.1-2.el9_4 | 0:1.22.1-2.el9_4 |
gstreamer1-plugins-ugly-free-debuginfoRed Hat:rhel_e4s:9.4::appstream |
before 0:1.22.1-2.el9_4 | 0:1.22.1-2.el9_4 |
gstreamer1-plugins-ugly-free-debugsourceRed Hat:rhel_e4s:9.4::appstream |
before 0:1.22.1-2.el9_4 | 0:1.22.1-2.el9_4 |
gstreamer1-plugins-ugly-freeRed Hat:rhel_e4s:9.2::appstream |
before 0:1.18.4-4.el9_2 | 0:1.18.4-4.el9_2 |
gstreamer1-plugins-ugly-free-debuginfoRed Hat:rhel_e4s:9.2::appstream |
before 0:1.18.4-4.el9_2 | 0:1.18.4-4.el9_2 |
gstreamer1-plugins-ugly-free-debugsourceRed Hat:rhel_e4s:9.2::appstream |
before 0:1.18.4-4.el9_2 | 0:1.18.4-4.el9_2 |
gstreamer1-plugins-ugly-freeRocky Linux:10 |
before 0:1.26.7-2.el10_2.2 | 0:1.26.7-2.el10_2.2 |
gstreamer1-plugins-bad-freeRocky Linux:9 From an advisory covering 2 CVEs |
before 0:1.22.12-7.el9_8.4 | 0:1.22.12-7.el9_8.4 |
gstreamer1-plugins-ugly-freeRocky Linux:9 From an advisory covering 2 CVEs |
before 0:1.22.12-6.el9_8.2 | 0:1.22.12-6.el9_8.2 |
gst-plugins-ugly1.0Ubuntu:Pro:16.04:LTS |
before 1.8.3-1ubuntu0.1+esm2, plus listed versions 1.6.0-1ubuntu11.6.1-1ubuntu11.6.2-1ubuntu11.7.1-1ubuntu11.7.2-1ubuntu1 Show 7 moreShow less1.7.90-1ubuntu11.7.91-1ubuntu11.8.0-1ubuntu11.8.1-1ubuntu0.11.8.2-1ubuntu0.11.8.3-1ubuntu0.11.8.3-1ubuntu0.1+esm1 |
1.8.3-1ubuntu0.1+esm2 |
gst-plugins-ugly1.0Ubuntu:Pro:18.04:LTS |
before 1.14.5-0ubuntu1~18.04.1+esm1, plus listed versions 1.12.3-11.12.3-1build11.12.4-11.12.4-1build11.13.1-1 Show 5 moreShow less1.13.91-11.14.0-11.14.1-1~ubuntu18.04.11.14.4-1~ubuntu18.04.11.14.5-0ubuntu1~18.04.1 |
1.14.5-0ubuntu1~18.04.1+esm1 |
gst-plugins-ugly1.0Ubuntu:Pro:20.04:LTS |
before 1.16.2-2ubuntu0.1~esm1, plus listed versions 1.16.1-11.16.1-1build11.16.2-11.16.2-21.16.2-2build1 |
1.16.2-2ubuntu0.1~esm1 |
gst-plugins-ugly1.0Ubuntu:Pro:22.04:LTS |
before 1.20.1-1ubuntu0.1~esm1, plus listed versions 1.18.5-11.20.0-11.20.0-1build11.20.1-1 |
1.20.1-1ubuntu0.1~esm1 |
gst-plugins-ugly1.0Ubuntu:Pro:24.04:LTS |
before 1.24.1-1ubuntu0.1~esm1, plus listed versions 1.22.5-11.22.6-11.22.7-11.22.8-11.22.10-11.24.1-11.24.1-1build1 |
1.24.1-1ubuntu0.1~esm1 |
gst-plugins-ugly1.0Ubuntu:Pro:26.04:LTS |
before 1.28.2-1ubuntu0.1~esm1, plus listed versions 1.26.6-11.26.7-1build11.27.2-11.27.90-11.28.0-11.28.1-11.28.2-1 |
1.28.2-1ubuntu0.1~esm1 |
gst-plugins-ugly1.0Ubuntu:Pro:16.04:LTS From an advisory covering 7 CVEs |
before 1.8.3-1ubuntu0.1+esm2, plus listed versions 1.6.0-1ubuntu11.6.1-1ubuntu11.6.2-1ubuntu11.7.1-1ubuntu11.7.2-1ubuntu1 Show 7 moreShow less1.7.90-1ubuntu11.7.91-1ubuntu11.8.0-1ubuntu11.8.1-1ubuntu0.11.8.2-1ubuntu0.11.8.3-1ubuntu0.11.8.3-1ubuntu0.1+esm1 |
1.8.3-1ubuntu0.1+esm2 |
gst-plugins-ugly1.0Ubuntu:Pro:18.04:LTS From an advisory covering 7 CVEs |
before 1.14.5-0ubuntu1~18.04.1+esm1, plus listed versions 1.12.3-11.12.3-1build11.12.4-11.12.4-1build11.13.1-1 Show 5 moreShow less1.13.91-11.14.0-11.14.1-1~ubuntu18.04.11.14.4-1~ubuntu18.04.11.14.5-0ubuntu1~18.04.1 |
1.14.5-0ubuntu1~18.04.1+esm1 |
gst-plugins-ugly1.0Ubuntu:Pro:20.04:LTS From an advisory covering 7 CVEs |
before 1.16.2-2ubuntu0.1~esm1, plus listed versions 1.16.1-11.16.1-1build11.16.2-11.16.2-21.16.2-2build1 |
1.16.2-2ubuntu0.1~esm1 |
gst-plugins-ugly1.0Ubuntu:Pro:22.04:LTS From an advisory covering 7 CVEs |
before 1.20.1-1ubuntu0.1~esm1, plus listed versions 1.18.5-11.20.0-11.20.0-1build11.20.1-1 |
1.20.1-1ubuntu0.1~esm1 |
gst-plugins-ugly1.0Ubuntu:Pro:24.04:LTS From an advisory covering 7 CVEs |
before 1.24.1-1ubuntu0.1~esm1, plus listed versions 1.22.5-11.22.6-11.22.7-11.22.8-11.22.10-11.24.1-11.24.1-1build1 |
1.24.1-1ubuntu0.1~esm1 |
gst-plugins-ugly1.0Ubuntu:Pro:26.04:LTS From an advisory covering 7 CVEs |
before 1.28.2-1ubuntu0.1~esm1, plus listed versions 1.26.6-11.26.7-1build11.27.2-11.27.90-11.28.0-11.28.1-11.28.2-1 |
1.28.2-1ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected | EUVD, NVD, OSV | |
| facts | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-19389 is a high vulnerability (CVSS 7.1) in Red Hat Enterprise Linux 10, published August 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in gstreamer1-plugins-ugly-free 1.26.7-2.el10_2.2.
References
access.redhat.com/errata/RHSA-2026:55435
Show 36 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2513016
gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12233
gstreamer.freedesktop.org/releases/1.28
nvd.nist.gov/vuln/detail/CVE-2026-19389
github.com/advisories/GHSA-p44h-f9j6-g9ff
errata.almalinux.org/10/ALSA-2026-55435.html
errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1787309460.html
security-tracker.debian.org/tracker/CVE-2026-19389
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55435.json
cve.org/CVERecord?id=CVE-2026-19389
errata.rockylinux.org/RLSA-2026:55435
ubuntu.com/security/CVE-2026-19389
Left out here: 15 versions. The JSON record has them.