Skip to content

CVE-2026-52719

Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds read via jpeg segment length validation in va decoder

7.1 HighFix available

An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser reads a segment length value from the bitstream without validating it against available data. A remote attacker could trick a user into opening a specially crafted JPEG file, causing downstream parsing to read beyond the provided input buffer, leading to a crash or potential information disclosure.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: High

Exploit likelihood

0.34%Up 0.1 points since Jun 16, 2026

What each source reports

CVE List Score used 7.1

Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds read via jpeg segment length validation in va decoder

An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser reads a segment length value from the bitstream without validating it against available data. A remote attacker could trick a user into opening a specially crafted JPEG file, causing downstream parsing to read beyond the provided input buffer, leading to a crash or potential information disclosure.

Record: CVE-2026-52719
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Weakness: CWE-125, CWE-125
Updated: 2026-11-04

EUVDEUVD-2026-36798 7.1

An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser reads a segment length value from the bitstream without validating it against available data. A remote attacker could trick a user into opening a specially crafted JPEG file, causing downstream parsing to read beyond the provided input buffer, leading to a crash or potential information disclosure.

Record: EUVD-2026-36798
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Updated: 2026-11-05

GitHub AdvisoriesGHSA-33x5-f9c4-3q24 7.1

An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins...

An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser reads a segment length value from the bitstream without validating it against available data. A remote attacker could trick a user into opening a specially crafted JPEG file, causing downstream parsing to read beyond the provided input buffer, leading to a crash or potential information disclosure.

Record: GHSA-33x5-f9c4-3q24
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

NVD 7.1

An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser reads a segment length value from the bitstream without validating it against available data. A remote attacker could trick a user into opening a specially crafted JPEG file, causing downstream parsing to read beyond the provided input buffer, leading to a crash or potential information disclosure.

Record: CVE-2026-52719
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-05

OSVDEBIAN-CVE-2026-52719 7.1

An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser reads a segment length value from the bitstream without validating it against available data. A remote attacker could trick a user into opening a specially crafted JPEG file, causing downstream parsing to read beyond the provided input buffer, leading to a crash or potential information disclosure.

Record: DEBIAN-CVE-2026-52719
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Updated: 2026-11-05

OSVRHSA-2026:36749 8.8

Red Hat Security Advisory: gstreamer1-plugins-bad-free security update

Record: RHSA-2026:36749
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 13 moreShow less

OSVRHSA-2026:36834 8.8

Red Hat Security Advisory: gstreamer1-plugins-bad-free security update

Record: RHSA-2026:36834
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:47070 8.8

Red Hat Security Advisory: gstreamer1-plugins-bad-free security update

Record: RHSA-2026:47070
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:47071 8.8

Red Hat Security Advisory: gstreamer1-plugins-bad-free security update

Record: RHSA-2026:47071
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:47717 8.8

Red Hat Security Advisory: gstreamer1-plugins-bad-free security update

Record: RHSA-2026:47717
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:36749 8.8

Important: gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

Security Fix(es):

gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion (CVE-2026-52718)
gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder (CVE-2026-52719)
gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720)
gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:36749
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:36834 8.8

Important: gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

Security Fix(es):

gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion (CVE-2026-52718)
gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder (CVE-2026-52719)
gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720)
gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:36834
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-52719 7.1

An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser reads a segment length value from the bitstream without validating it against available data. A remote attacker could trick a user into opening a specially crafted JPEG file, causing downstream parsing to read beyond the provided input buffer, leading to a crash or potential information disclosure.

Record: UBUNTU-CVE-2026-52719
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Updated: 2026-11-02

OSVALSA-2026:36749 No score

Important: gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

Security Fix(es):

gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion (CVE-2026-52718)
gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder (CVE-2026-52719)
gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720)
gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:36749
Updated: 2026-11-02

OSVALSA-2026:36834 No score

Important: gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

Security Fix(es):

gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion (CVE-2026-52718)
gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder (CVE-2026-52719)
gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720)
gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:36834
Updated: 2026-11-02

OSVCLSA-2026-1784117778 No score

gstreamer1-plugins-bad-free: Fix of 4 CVEs

CVE-2026-52718: fix av1parser bytes/bits confusion when parsing tile data size
CVE-2026-52719: fix vajpegdecoder out-of-bounds read on invalid JPEG segment length
CVE-2026-52720: fix librfb framebuffer rectangle bounds check (dimensions not area)
CVE-2026-52722: fix vmnc signed integer overflow in cursor dimension arithmetic

Record: CLSA-2026-1784117778
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21204-1 No score

Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issue

CVE-2026-52719: gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder (bsc#1268401).

Record: openSUSE-SU-2026:21204-1
Updated: 2026-11-02

OSVSUSE-SU-2026:2743-1 No score

Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issue

CVE-2026-52719: gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder (bsc#1268401).

Record: SUSE-SU-2026:2743-1
Updated: 2026-11-02

OSVSUSE-SU-2026:2744-1 No score

Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issue

CVE-2026-52719: gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder (bsc#1268401).

Record: SUSE-SU-2026:2744-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`gstreamer1-plugins-bad-free` AlmaLinux:10 From an advisory covering 4 CVEs	before 1.26.7-2.el10_2.4	1.26.7-2.el10_2.4
`gstreamer1-plugins-bad-free-devel` AlmaLinux:10 From an advisory covering 4 CVEs	before 1.26.7-2.el10_2.4	1.26.7-2.el10_2.4
`gstreamer1-plugins-bad-free-libs` AlmaLinux:10 From an advisory covering 4 CVEs	before 1.26.7-2.el10_2.4	1.26.7-2.el10_2.4
`gstreamer1-plugins-bad-free` AlmaLinux:9 From an advisory covering 4 CVEs	before 1.22.12-7.el9_8.1	1.22.12-7.el9_8.1
`gstreamer1-plugins-bad-free-devel` AlmaLinux:9 From an advisory covering 4 CVEs	before 1.22.12-7.el9_8.1	1.22.12-7.el9_8.1
`gstreamer1-plugins-bad-free-libs` AlmaLinux:9 From an advisory covering 4 CVEs	before 1.22.12-7.el9_8.1	1.22.12-7.el9_8.1
`gstreamer1-plugins-bad-free` TuxCare:AlmaLinux:9.6 From an advisory covering 4 CVEs	before 1.22.12-4.el9_6.tuxcare.els2	1.22.12-4.el9_6.tuxcare.els2
`gstreamer1-plugins-bad-free-devel` TuxCare:AlmaLinux:9.6 From an advisory covering 4 CVEs	before 1.22.12-4.el9_6.tuxcare.els2	1.22.12-4.el9_6.tuxcare.els2
`gstreamer1-plugins-bad-free-libs` TuxCare:AlmaLinux:9.6 From an advisory covering 4 CVEs	before 1.22.12-4.el9_6.tuxcare.els2	1.22.12-4.el9_6.tuxcare.els2
`gst-plugins-bad1.0` Debian:12	before 1.22.0-4+deb12u8, plus listed versions 1.22.0-41.22.0-4+deb12u11.22.0-4+deb12u21.22.0-4+deb12u31.22.0-4+deb12u41.22.0-4+deb12u51.22.0-4+deb12u61.22.0-4+deb12u7	1.22.0-4+deb12u8

Show 56 moreShow less

Affected packages
Package	Affected	Fixed
`gst-plugins-bad1.0` Debian:13	before 1.26.2-3+deb13u2, plus listed versions 1.26.2-31.26.2-3+deb13u1	1.26.2-3+deb13u2
`gst-plugins-bad1.0` Debian:14	before 1.28.4-1, plus listed versions 1.26.10-11.26.10-21.26.2-31.26.3-11.26.4-1 Show 24 moreShow less 1.26.5-11.26.5-21.26.6-11.26.6-21.26.6-31.26.6-41.26.6-51.26.7-11.26.7-21.26.8-11.26.9-11.27.1-11.27.2-11.27.50-11.27.90-11.27.90-21.27.90-31.28.0-11.28.1-11.28.1-21.28.1-31.28.2-11.28.2-21.28.3-1	1.28.4-1
`gstreamer1-plugins-bad-free` Red Hat:enterprise_linux:10.2 From an advisory covering 4 CVEs	before 0:1.26.7-2.el10_2.4	0:1.26.7-2.el10_2.4
`gstreamer1-plugins-bad-free-debuginfo` Red Hat:enterprise_linux:10.2 From an advisory covering 4 CVEs	before 0:1.26.7-2.el10_2.4	0:1.26.7-2.el10_2.4
`gstreamer1-plugins-bad-free-debugsource` Red Hat:enterprise_linux:10.2 From an advisory covering 4 CVEs	before 0:1.26.7-2.el10_2.4	0:1.26.7-2.el10_2.4
`gstreamer1-plugins-bad-free-libs` Red Hat:enterprise_linux:10.2 From an advisory covering 4 CVEs	before 0:1.26.7-2.el10_2.4	0:1.26.7-2.el10_2.4
`gstreamer1-plugins-bad-free-libs-debuginfo` Red Hat:enterprise_linux:10.2 From an advisory covering 4 CVEs	before 0:1.26.7-2.el10_2.4	0:1.26.7-2.el10_2.4
`gstreamer1-plugins-bad-free-devel` Red Hat:enterprise_linux:10.2 From an advisory covering 4 CVEs	before 0:1.26.7-2.el10_2.4	0:1.26.7-2.el10_2.4
`gstreamer1-plugins-bad-free` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:1.22.12-7.el9_8.1	0:1.22.12-7.el9_8.1
`gstreamer1-plugins-bad-free-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:1.22.12-7.el9_8.1	0:1.22.12-7.el9_8.1
`gstreamer1-plugins-bad-free-debugsource` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:1.22.12-7.el9_8.1	0:1.22.12-7.el9_8.1
`gstreamer1-plugins-bad-free-libs` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:1.22.12-7.el9_8.1	0:1.22.12-7.el9_8.1
`gstreamer1-plugins-bad-free-libs-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:1.22.12-7.el9_8.1	0:1.22.12-7.el9_8.1
`gstreamer1-plugins-bad-free-debuginfo` Red Hat:enterprise_linux:9::crb From an advisory covering 4 CVEs	before 0:1.22.12-7.el9_8.1	0:1.22.12-7.el9_8.1
`gstreamer1-plugins-bad-free-debugsource` Red Hat:enterprise_linux:9::crb From an advisory covering 4 CVEs	before 0:1.22.12-7.el9_8.1	0:1.22.12-7.el9_8.1
`gstreamer1-plugins-bad-free-devel` Red Hat:enterprise_linux:9::crb From an advisory covering 4 CVEs	before 0:1.22.12-7.el9_8.1	0:1.22.12-7.el9_8.1
`gstreamer1-plugins-bad-free-libs-debuginfo` Red Hat:enterprise_linux:9::crb From an advisory covering 4 CVEs	before 0:1.22.12-7.el9_8.1	0:1.22.12-7.el9_8.1
`gstreamer1-plugins-bad-free` Red Hat:rhel_eus:9.6::appstream From an advisory covering 4 CVEs	before 0:1.22.12-5.el9_6.4	0:1.22.12-5.el9_6.4
`gstreamer1-plugins-bad-free-debuginfo` Red Hat:rhel_eus:9.6::appstream From an advisory covering 4 CVEs	before 0:1.22.12-5.el9_6.4	0:1.22.12-5.el9_6.4
`gstreamer1-plugins-bad-free-debugsource` Red Hat:rhel_eus:9.6::appstream From an advisory covering 4 CVEs	before 0:1.22.12-5.el9_6.4	0:1.22.12-5.el9_6.4
`gstreamer1-plugins-bad-free-libs` Red Hat:rhel_eus:9.6::appstream From an advisory covering 4 CVEs	before 0:1.22.12-5.el9_6.4	0:1.22.12-5.el9_6.4
`gstreamer1-plugins-bad-free-libs-debuginfo` Red Hat:rhel_eus:9.6::appstream From an advisory covering 4 CVEs	before 0:1.22.12-5.el9_6.4	0:1.22.12-5.el9_6.4
`gstreamer1-plugins-bad-free-debuginfo` Red Hat:rhel_eus:9.6::crb From an advisory covering 4 CVEs	before 0:1.22.12-5.el9_6.4	0:1.22.12-5.el9_6.4
`gstreamer1-plugins-bad-free-debugsource` Red Hat:rhel_eus:9.6::crb From an advisory covering 4 CVEs	before 0:1.22.12-5.el9_6.4	0:1.22.12-5.el9_6.4
`gstreamer1-plugins-bad-free-devel` Red Hat:rhel_eus:9.6::crb From an advisory covering 4 CVEs	before 0:1.22.12-5.el9_6.4	0:1.22.12-5.el9_6.4
`gstreamer1-plugins-bad-free-libs-debuginfo` Red Hat:rhel_eus:9.6::crb From an advisory covering 4 CVEs	before 0:1.22.12-5.el9_6.4	0:1.22.12-5.el9_6.4
`gstreamer1-plugins-bad-free` Red Hat:rhel_e4s:9.4::appstream From an advisory covering 4 CVEs	before 0:1.22.1-6.el9_4.4	0:1.22.1-6.el9_4.4
`gstreamer1-plugins-bad-free-debuginfo` Red Hat:rhel_e4s:9.4::appstream From an advisory covering 4 CVEs	before 0:1.22.1-6.el9_4.4	0:1.22.1-6.el9_4.4
`gstreamer1-plugins-bad-free-debugsource` Red Hat:rhel_e4s:9.4::appstream From an advisory covering 4 CVEs	before 0:1.22.1-6.el9_4.4	0:1.22.1-6.el9_4.4
`gstreamer1-plugins-bad-free` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 4 CVEs	before 0:1.24.11-3.el10_0.4	0:1.24.11-3.el10_0.4
`gstreamer1-plugins-bad-free-debuginfo` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 4 CVEs	before 0:1.24.11-3.el10_0.4	0:1.24.11-3.el10_0.4
`gstreamer1-plugins-bad-free-debugsource` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 4 CVEs	before 0:1.24.11-3.el10_0.4	0:1.24.11-3.el10_0.4
`gstreamer1-plugins-bad-free-libs` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 4 CVEs	before 0:1.24.11-3.el10_0.4	0:1.24.11-3.el10_0.4
`gstreamer1-plugins-bad-free-libs-debuginfo` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 4 CVEs	before 0:1.24.11-3.el10_0.4	0:1.24.11-3.el10_0.4
`gstreamer1-plugins-bad-free-devel` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 4 CVEs	before 0:1.24.11-3.el10_0.4	0:1.24.11-3.el10_0.4
`gstreamer1-plugins-bad-free` Rocky Linux:10 From an advisory covering 4 CVEs	before 0:1.26.7-2.el10_2.4	0:1.26.7-2.el10_2.4
`gstreamer1-plugins-bad-free` Rocky Linux:9 From an advisory covering 4 CVEs	before 0:1.22.12-7.el9_8.1	0:1.22.12-7.el9_8.1
`gstreamer-plugins-bad` SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS	before 1.22.0-150500.3.31.1	1.22.0-150500.3.31.1
`gstreamer-plugins-bad` SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS	before 1.22.0-150500.3.31.1	1.22.0-150500.3.31.1
`gstreamer-plugins-bad` SUSE:Linux Enterprise Server 15 SP5-LTSS	before 1.22.0-150500.3.31.1	1.22.0-150500.3.31.1
`gstreamer-plugins-bad` SUSE:Linux Enterprise Server for SAP Applications 15 SP5	before 1.22.0-150500.3.31.1	1.22.0-150500.3.31.1
`gstreamer-plugins-bad` SUSE:Linux Enterprise Module for Basesystem 15 SP7	before 1.24.0-150600.4.6.1	1.24.0-150600.4.6.1
`gstreamer-plugins-bad` SUSE:Linux Enterprise Module for Desktop Applications 15 SP7	before 1.24.0-150600.4.6.1	1.24.0-150600.4.6.1
`gstreamer-plugins-bad` SUSE:Linux Enterprise Module for Package Hub 15 SP7	before 1.24.0-150600.4.6.1	1.24.0-150600.4.6.1
`gstreamer-plugins-bad` SUSE:Linux Enterprise Server 15 SP6-LTSS	before 1.24.0-150600.4.6.1	1.24.0-150600.4.6.1
`gstreamer-plugins-bad` SUSE:Linux Enterprise Server for SAP Applications 15 SP6	before 1.24.0-150600.4.6.1	1.24.0-150600.4.6.1
`gst-plugins-bad1.0` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 1.2.0-3ubuntu51.2.1-1ubuntu11.2.1-1ubuntu21.2.2-1ubuntu11.2.2-1ubuntu2 Show 6 moreShow less 1.2.2-1ubuntu41.2.3-1ubuntu11.2.3-1ubuntu21.2.4-1~ubuntu11.2.4-1~ubuntu1.11.2.4-1~ubuntu1.1+esm1	None known
`gst-plugins-bad1.0` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 1.6.0-1ubuntu11.6.1-1ubuntu11.6.2-1ubuntu11.7.1-1ubuntu11.7.1-1ubuntu3 Show 11 moreShow less 1.7.1-1ubuntu41.7.2-1ubuntu11.7.90-1ubuntu21.7.91-1ubuntu11.8.0-1ubuntu11.8.1-1ubuntu0.11.8.2-1ubuntu0.11.8.2-1ubuntu0.21.8.3-1ubuntu0.21.8.3-1ubuntu0.2+esm11.8.3-1ubuntu0.2+esm2	None known
`gst-plugins-bad1.0` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 1.12.3-1ubuntu11.12.3-1ubuntu21.12.3-2ubuntu11.12.4-2ubuntu11.12.4-2ubuntu2 Show 8 moreShow less 1.13.1-1ubuntu11.13.91-1ubuntu11.14.0-1ubuntu11.14.1-1ubuntu1~ubuntu18.04.11.14.4-1ubuntu1~ubuntu18.04.11.14.5-0ubuntu1~18.04.11.14.5-0ubuntu1~18.04.1+esm11.14.5-0ubuntu1~18.04.1+esm2	None known
`gst-plugins-bad1.0` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 1.16.1-1ubuntu11.16.1-1ubuntu31.16.1-1ubuntu41.16.1-1ubuntu51.16.1-1ubuntu6 Show 9 moreShow less 1.16.1-1ubuntu81.16.2-1ubuntu11.16.2-1ubuntu21.16.2-2ubuntu11.16.2-2.1ubuntu11.16.3-0ubuntu11.16.3-0ubuntu1.11.16.3-0ubuntu1.1+esm11.16.3-0ubuntu1.1+esm2	None known
`gst-plugins-bad1.0` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 1.18.5-1ubuntu11.18.5-1ubuntu31.20.0-2ubuntu21.20.1-1ubuntu21.20.3-0ubuntu11.20.3-0ubuntu1.11.20.3-0ubuntu1.1+esm21.20.3-0ubuntu1.1+esm3	None known
`gst-plugins-bad1.0` Ubuntu:Pro:24.04:LTS	All versions, plus listed versions 1.22.4-1ubuntu11.22.4-1ubuntu21.22.4-1ubuntu41.22.9-2ubuntu11.24.0-1ubuntu3 Show 4 moreShow less 1.24.0-1ubuntu41.24.2-1ubuntu41.24.2-1ubuntu4+esm11.24.2-1ubuntu4+esm2	None known
`gst-plugins-bad1.0` Ubuntu:25.10	All versions, plus listed versions 1.26.0-1ubuntu21.26.2-1ubuntu11.26.3-1ubuntu11.26.4-1ubuntu11.26.5-1ubuntu2	None known
`gst-plugins-bad1.0` Ubuntu:26.10	All versions, plus listed versions 1.28.2-1ubuntu11.28.2-1ubuntu21.28.4-1ubuntu11.28.4-1ubuntu21.28.6-1ubuntu1	None known
`gst-plugins-bad1.0` Ubuntu:26.04:LTS	All versions, plus listed versions 1.26.5-1ubuntu21.27.2-1ubuntu11.27.90-1ubuntu21.28.0-1ubuntu21.28.1-2ubuntu2 Show 4 moreShow less 1.28.1-2ubuntu31.28.2-1ubuntu11.28.2-1ubuntu1.11.28.2-1ubuntu1.2	None known
`gstreamer-plugins-bad` openSUSE:Leap 16.0	before 1.26.7-160000.2.1	1.26.7-160000.2.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected	EUVD, NVD, OSV
Nov 4, 2026	facts	CVE List
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-52719 is a high vulnerability (CVSS 7.1) in Red Hat Enterprise Linux 10, published June 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in gst-plugins-bad1.0 1.22.0-4+deb12u8.

References

Show 44 moreShow less