Every CVE Search/ Get API key

CVE-2026-2922

GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability

7.8 HighFix available

GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the processing of video packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28845.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.45%Up 0.4 points since Mar 14, 2026
90%50%10%1%

What each source reports

CVE List 7.8

GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability

GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the processing of video packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28845.

Record
CVE-2026-2922
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-787, CWE-787
Updated
2026-11-02
EUVDEUVD-2026-12117 7.8

GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the processing of video packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28845.

Record
EUVD-2026-12117
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-hjx5-q68f-pv56 7.8

GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability. This...

GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the processing of video packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28845.

Record
GHSA-hjx5-q68f-pv56
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
NVD 7.8

GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the processing of video packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28845.

Record
CVE-2026-2922
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
OSV 7.8

GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability

GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the processing of video packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28845.

Record
CVE-2026-2922
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
OSVDEBIAN-CVE-2026-2922 7.8

GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of video packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28845.

Record
DEBIAN-CVE-2026-2922
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 21 moreShow less
OSVRHSA-2026:19024 8.8

Red Hat Security Advisory: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update

Record
RHSA-2026:19024
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:19180 8.8

Red Hat Security Advisory: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update

Record
RHSA-2026:19180
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:6259 8.8

Red Hat Security Advisory: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update

Record
RHSA-2026:6259
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:6300 8.8

Red Hat Security Advisory: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update

Record
RHSA-2026:6300
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:8854 8.8

Red Hat Security Advisory: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update

Record
RHSA-2026:8854
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:8862 8.8

Red Hat Security Advisory: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update

Record
RHSA-2026:8862
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:19024 8.8

Important: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

Security Fix(es):

  • GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920)

  • GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser (CVE-2026-3082)

  • GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay (CVE-2026-3085)

  • GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling (CVE-2026-2921)

  • GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083)

  • GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922)

  • GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling (CVE-2026-2923)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:19024
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:19180 8.8

Important: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

Security Fix(es):

  • GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920)

  • GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser (CVE-2026-3082)

  • GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay (CVE-2026-3085)

  • GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling (CVE-2026-2921)

  • GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083)

  • GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922)

  • GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling (CVE-2026-2923)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:19180
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:6259 8.8

Important: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

Security Fix(es):

  • GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920)

  • GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser (CVE-2026-3082)

  • GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay (CVE-2026-3085)

  • GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling (CVE-2026-2921)

  • GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083)

  • GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922)

  • GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling (CVE-2026-2923)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:6259
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:6300 8.8

Important: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

Security Fix(es):

  • GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920)

  • GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser (CVE-2026-3082)

  • GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay (CVE-2026-3085)

  • GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling (CVE-2026-2921)

  • GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083)

  • GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922)

  • GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling (CVE-2026-2923)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:6300
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-2922 7.8

GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of video packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28845.

Record
UBUNTU-CVE-2026-2922
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2026:19024 No score

Important: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

Security Fix(es):

  • GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920)
  • GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser (CVE-2026-3082)
  • GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay (CVE-2026-3085)
  • GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling (CVE-2026-2921)
  • GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083)
  • GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922)
  • GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling (CVE-2026-2923)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:19024
Updated
2026-11-02
OSVALSA-2026:19180 No score

Important: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

Security Fix(es):

  • GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920)
  • GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser (CVE-2026-3082)
  • GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay (CVE-2026-3085)
  • GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling (CVE-2026-2921)
  • GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083)
  • GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922)
  • GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling (CVE-2026-2923)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:19180
Updated
2026-11-02
OSVALSA-2026:6259 No score

Important: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

Security Fix(es):

  • GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920)
  • GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser (CVE-2026-3082)
  • GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay (CVE-2026-3085)
  • GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling (CVE-2026-2921)
  • GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083)
  • GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922)
  • GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling (CVE-2026-2923)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:6259
Updated
2026-11-02
OSVALSA-2026:6300 No score

Important: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

Security Fix(es):

  • GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920)
  • GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser (CVE-2026-3082)
  • GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay (CVE-2026-3085)
  • GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling (CVE-2026-2921)
  • GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083)
  • GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922)
  • GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling (CVE-2026-2923)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:6300
Updated
2026-11-02
OSVCLSA-2026-1777460813 No score

gstreamer1-plugins-ugly-free: Fix of 2 CVEs

  • CVE-2026-2920: asfdemux: error out on files with more than 32 streams
  • CVE-2026-2922: rmdemux: check fragment overflow before storing
  • CVE-2026-2922: rmdemux: avoid integer overflow when checking video fragment size
Record
CLSA-2026-1777460813
Updated
2026-11-02
OSVMGASA-2026-0222 No score

Updated gstreamer1.0-plugins-bad, gstreamer1.0-plugins-base, gstreamer1.0-plugins-good & gstreamer1.0-plugins-ugly packages fix security vulnerabilities

CVE-2026-2921, GStreamer RIFF Palette Integer Overflow Remote Code Execution Vulnerability CVE-2026-2923.GStreamer DVB Subtitles Out-Of-Bounds Write Remote Code Execution Vulnerability CVE-2026-3082, GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability CVE-2026-3085, GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability CVE-2026-2920, GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability CVE-2026-2922, GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability CVE-2026-1940, Gstreamer: incomplete fix of CVE-2026-1940

Record
MGASA-2026-0222
Updated
2026-11-02
OSVopenSUSE-SU-2026:20402-1 No score

Security update for gstreamer-plugins-ugly

This update for gstreamer-plugins-ugly fixes the following issues:

  • CVE-2026-2920: GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability (bsc#1259367).
  • CVE-2026-2922: GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability (bsc#1259370).
Record
openSUSE-SU-2026:20402-1
Updated
2026-11-02
OSVSUSE-SU-2026:0998-1 No score

Security update for gstreamer-plugins-ugly

This update for gstreamer-plugins-ugly fixes the following issues:

  • CVE-2026-2920: GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability (bsc#1259367).
  • CVE-2026-2922: GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability (bsc#1259370).
Record
SUSE-SU-2026:0998-1
Updated
2026-11-02
OSVSUSE-SU-2026:20915-1 No score

Security update for gstreamer-plugins-ugly

This update for gstreamer-plugins-ugly fixes the following issues:

  • CVE-2026-2920: GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability (bsc#1259367).
  • CVE-2026-2922: GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability (bsc#1259370).
Record
SUSE-SU-2026:20915-1
Updated
2026-11-02
OSVUSN-8896-1 No score

gst-plugins-ugly1.0 vulnerabilities

Michael Randrianantenaina discovered that GStreamer's Ugly Plugins incorrectly handled certain malformed RealMedia files. If a user were tricked into opening a crafted media file, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-38103, CVE-2023-38104)

It was discovered that GStreamer's Ugly Plugins incorrectly handled certain malformed ASF and RealMedia files. If a user were tricked into opening a crafted media file, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-2920, CVE-2026-2922)

Tianshuo Han discovered that GStreamer's Ugly Plugins incorrectly handled certain malformed RealMedia files. If a user were tricked into opening a crafted media file, an attacker could possibly use this issue to cause a denial of service or expose sensitive information. (CVE-2026-53703, CVE-2026-53704)

Seonwook Kim discovered that GStreamer's Ugly Plugins incorrectly handled certain malformed ASF files. If a user were tricked into opening a crafted media file, an attacker could possibly use this issue to cause a denial of service or expose sensitive information. (CVE-2026-19389)

Record
USN-8896-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gstreamer1-plugins-bad-free
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1.26.7-2.el10_2
1.26.7-2.el10_2
gstreamer1-plugins-bad-free-devel
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1.26.7-2.el10_2
1.26.7-2.el10_2
gstreamer1-plugins-bad-free-libs
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1.26.7-2.el10_2
1.26.7-2.el10_2
gstreamer1-plugins-base
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1.26.7-2.el10_2
1.26.7-2.el10_2
gstreamer1-plugins-base-devel
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1.26.7-2.el10_2
1.26.7-2.el10_2
gstreamer1-plugins-base-tools
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1.26.7-2.el10_2
1.26.7-2.el10_2
gstreamer1-plugins-good
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1.26.7-2.el10_2
1.26.7-2.el10_2
gstreamer1-plugins-good-gtk
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1.26.7-2.el10_2
1.26.7-2.el10_2
gstreamer1-plugins-ugly-free
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1.26.7-2.el10_2
1.26.7-2.el10_2
gstreamer1-plugins-bad-free
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1.22.12-7.el9_8
1.22.12-7.el9_8
Show 205 moreShow less
Affected packages
PackageAffectedFixed
gstreamer1-plugins-bad-free-devel
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1.22.12-7.el9_8
1.22.12-7.el9_8
gstreamer1-plugins-bad-free-libs
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1.22.12-7.el9_8
1.22.12-7.el9_8
gstreamer1-plugins-base
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1.22.12-8.el9_8
1.22.12-8.el9_8
gstreamer1-plugins-base-devel
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1.22.12-8.el9_8
1.22.12-8.el9_8
gstreamer1-plugins-base-tools
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1.22.12-8.el9_8
1.22.12-8.el9_8
gstreamer1-plugins-good
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1.22.12-7.el9_8
1.22.12-7.el9_8
gstreamer1-plugins-good-gtk
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1.22.12-7.el9_8
1.22.12-7.el9_8
gstreamer1-plugins-ugly-free
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1.22.12-6.el9_8
1.22.12-6.el9_8
gstreamer1-plugins-bad-free
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1.24.11-3.el10_1
1.24.11-3.el10_1
gstreamer1-plugins-bad-free-devel
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1.24.11-3.el10_1
1.24.11-3.el10_1
gstreamer1-plugins-bad-free-libs
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1.24.11-3.el10_1
1.24.11-3.el10_1
gstreamer1-plugins-base
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1.24.11-2.el10_1
1.24.11-2.el10_1
gstreamer1-plugins-base-devel
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1.24.11-2.el10_1
1.24.11-2.el10_1
gstreamer1-plugins-base-tools
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1.24.11-2.el10_1
1.24.11-2.el10_1
gstreamer1-plugins-good
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1.24.11-2.el10_1
1.24.11-2.el10_1
gstreamer1-plugins-good-gtk
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1.24.11-2.el10_1
1.24.11-2.el10_1
gstreamer1-plugins-ugly-free
AlmaLinux:10
From an advisory covering 7 CVEs
 before 1.24.11-2.el10_1
1.24.11-2.el10_1
gstreamer1-plugins-bad-free
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1.22.12-5.el9_7
1.22.12-5.el9_7
gstreamer1-plugins-bad-free-devel
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1.22.12-5.el9_7
1.22.12-5.el9_7
gstreamer1-plugins-bad-free-libs
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1.22.12-5.el9_7
1.22.12-5.el9_7
gstreamer1-plugins-base
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1.22.12-5.el9_7
1.22.12-5.el9_7
gstreamer1-plugins-base-devel
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1.22.12-5.el9_7
1.22.12-5.el9_7
gstreamer1-plugins-base-tools
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1.22.12-5.el9_7
1.22.12-5.el9_7
gstreamer1-plugins-good
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1.22.12-5.el9_7
1.22.12-5.el9_7
gstreamer1-plugins-good-gtk
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1.22.12-5.el9_7
1.22.12-5.el9_7
gstreamer1-plugins-ugly-free
AlmaLinux:9
From an advisory covering 7 CVEs
 before 1.22.12-4.el9_7
1.22.12-4.el9_7
gstreamer1-plugins-ugly-free
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1.22.12-3.el9.tuxcare.els1
1.22.12-3.el9.tuxcare.els1
gst-plugins-ugly1.0
Debian:12
 before 1.22.0-2+deb12u2, plus listed versions
1.22.0-21.22.0-2+deb12u1
1.22.0-2+deb12u2
gst-plugins-ugly1.0
Debian:13
 before 1.26.3-4+deb13u1, plus listed versions
1.26.3-4
1.26.3-4+deb13u1
gst-plugins-ugly1.0
Debian:14
 before 1.28.1-1, plus listed versions
1.26.10-11.26.3-41.26.4-11.26.5-11.26.5-2
Show 10 moreShow less
1.26.6-11.26.7-11.26.8-11.26.9-11.27.1-11.27.2-11.27.50-11.27.50-21.27.90-11.28.0-1
1.28.1-1
gst-plugins-ugly1.0
Debian:11
From an advisory covering 2 CVEs
 before 1.18.4-2+deb11u2, plus listed versions
1.18.4-21.18.4-2+deb11u1
1.18.4-2+deb11u2
gstreamer1.0-plugins-bad
Mageia:9
From an advisory covering 8 CVEs
 before 1.22.11-1.2.mga9
1.22.11-1.2.mga9
gstreamer1.0-plugins-base
Mageia:9
From an advisory covering 8 CVEs
 before 1.22.11-1.3.mga9
1.22.11-1.3.mga9
gstreamer1.0-plugins-good
Mageia:9
From an advisory covering 8 CVEs
 before 1.22.11-1.2.mga9
1.22.11-1.2.mga9
gstreamer1.0-plugins-ugly
Mageia:9
From an advisory covering 8 CVEs
 before 1.22.11-1.1.mga9
1.22.11-1.1.mga9
gstreamer1.0-plugins-bad
Mageia:9
From an advisory covering 8 CVEs
 before 1.22.11-1.2.mga9.tainted
1.22.11-1.2.mga9.tainted
gstreamer1.0-plugins-ugly
Mageia:9
From an advisory covering 8 CVEs
 before 1.22.11-1.1.mga9.tainted
1.22.11-1.1.mga9.tainted
gstreamer1-plugins-bad-free
Red Hat:enterprise_linux:10.2
From an advisory covering 7 CVEs
 before 0:1.26.7-2.el10_2
0:1.26.7-2.el10_2
gstreamer1-plugins-bad-free-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 7 CVEs
 before 0:1.26.7-2.el10_2
0:1.26.7-2.el10_2
gstreamer1-plugins-bad-free-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 7 CVEs
 before 0:1.26.7-2.el10_2
0:1.26.7-2.el10_2
gstreamer1-plugins-bad-free-libs
Red Hat:enterprise_linux:10.2
From an advisory covering 7 CVEs
 before 0:1.26.7-2.el10_2
0:1.26.7-2.el10_2
gstreamer1-plugins-bad-free-libs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 7 CVEs
 before 0:1.26.7-2.el10_2
0:1.26.7-2.el10_2
gstreamer1-plugins-base
Red Hat:enterprise_linux:10.2
From an advisory covering 7 CVEs
 before 0:1.26.7-2.el10_2
0:1.26.7-2.el10_2
gstreamer1-plugins-base-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 7 CVEs
 before 0:1.26.7-2.el10_2
0:1.26.7-2.el10_2
gstreamer1-plugins-base-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 7 CVEs
 before 0:1.26.7-2.el10_2
0:1.26.7-2.el10_2
gstreamer1-plugins-base-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 7 CVEs
 before 0:1.26.7-2.el10_2
0:1.26.7-2.el10_2
gstreamer1-plugins-base-tools
Red Hat:enterprise_linux:10.2
From an advisory covering 7 CVEs
 before 0:1.26.7-2.el10_2
0:1.26.7-2.el10_2
gstreamer1-plugins-base-tools-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 7 CVEs
 before 0:1.26.7-2.el10_2
0:1.26.7-2.el10_2
gstreamer1-plugins-good
Red Hat:enterprise_linux:10.2
From an advisory covering 7 CVEs
 before 0:1.26.7-2.el10_2
0:1.26.7-2.el10_2
gstreamer1-plugins-good-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 7 CVEs
 before 0:1.26.7-2.el10_2
0:1.26.7-2.el10_2
gstreamer1-plugins-good-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 7 CVEs
 before 0:1.26.7-2.el10_2
0:1.26.7-2.el10_2
gstreamer1-plugins-good-gtk
Red Hat:enterprise_linux:10.2
From an advisory covering 7 CVEs
 before 0:1.26.7-2.el10_2
0:1.26.7-2.el10_2
gstreamer1-plugins-good-gtk-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 7 CVEs
 before 0:1.26.7-2.el10_2
0:1.26.7-2.el10_2
gstreamer1-plugins-good-qt6-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 7 CVEs
 before 0:1.26.7-2.el10_2
0:1.26.7-2.el10_2
gstreamer1-plugins-ugly-free
Red Hat:enterprise_linux:10.2
From an advisory covering 7 CVEs
 before 0:1.26.7-2.el10_2
0:1.26.7-2.el10_2
gstreamer1-plugins-ugly-free-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 7 CVEs
 before 0:1.26.7-2.el10_2
0:1.26.7-2.el10_2
gstreamer1-plugins-ugly-free-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 7 CVEs
 before 0:1.26.7-2.el10_2
0:1.26.7-2.el10_2
gstreamer1-plugins-bad-free-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 7 CVEs
 before 0:1.26.7-2.el10_2
0:1.26.7-2.el10_2
gstreamer1-plugins-bad-free
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-7.el9_8
0:1.22.12-7.el9_8
gstreamer1-plugins-bad-free-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-7.el9_8
0:1.22.12-7.el9_8
gstreamer1-plugins-bad-free-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-7.el9_8
0:1.22.12-7.el9_8
gstreamer1-plugins-bad-free-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-7.el9_8
0:1.22.12-7.el9_8
gstreamer1-plugins-bad-free-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-7.el9_8
0:1.22.12-7.el9_8
gstreamer1-plugins-base
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-8.el9_8
0:1.22.12-8.el9_8
gstreamer1-plugins-base-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-8.el9_8
0:1.22.12-8.el9_8
gstreamer1-plugins-base-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-8.el9_8
0:1.22.12-8.el9_8
gstreamer1-plugins-base-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-8.el9_8
0:1.22.12-8.el9_8
gstreamer1-plugins-base-tools
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-8.el9_8
0:1.22.12-8.el9_8
gstreamer1-plugins-base-tools-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-8.el9_8
0:1.22.12-8.el9_8
gstreamer1-plugins-good
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-7.el9_8
0:1.22.12-7.el9_8
gstreamer1-plugins-good-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-7.el9_8
0:1.22.12-7.el9_8
gstreamer1-plugins-good-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-7.el9_8
0:1.22.12-7.el9_8
gstreamer1-plugins-good-gtk
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-7.el9_8
0:1.22.12-7.el9_8
gstreamer1-plugins-good-gtk-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-7.el9_8
0:1.22.12-7.el9_8
gstreamer1-plugins-good-qt-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-7.el9_8
0:1.22.12-7.el9_8
gstreamer1-plugins-ugly-free
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-6.el9_8
0:1.22.12-6.el9_8
gstreamer1-plugins-ugly-free-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-6.el9_8
0:1.22.12-6.el9_8
gstreamer1-plugins-ugly-free-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-6.el9_8
0:1.22.12-6.el9_8
gstreamer1-plugins-bad-free-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 7 CVEs
 before 0:1.22.12-7.el9_8
0:1.22.12-7.el9_8
gstreamer1-plugins-bad-free-debugsource
Red Hat:enterprise_linux:9::crb
From an advisory covering 7 CVEs
 before 0:1.22.12-7.el9_8
0:1.22.12-7.el9_8
gstreamer1-plugins-bad-free-devel
Red Hat:enterprise_linux:9::crb
From an advisory covering 7 CVEs
 before 0:1.22.12-7.el9_8
0:1.22.12-7.el9_8
gstreamer1-plugins-bad-free-libs-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 7 CVEs
 before 0:1.22.12-7.el9_8
0:1.22.12-7.el9_8
gstreamer1-plugins-bad-free
Red Hat:enterprise_linux:10.1
From an advisory covering 7 CVEs
 before 0:1.24.11-3.el10_1
0:1.24.11-3.el10_1
gstreamer1-plugins-bad-free-debuginfo
Red Hat:enterprise_linux:10.1
From an advisory covering 7 CVEs
 before 0:1.24.11-3.el10_1
0:1.24.11-3.el10_1
gstreamer1-plugins-bad-free-debugsource
Red Hat:enterprise_linux:10.1
From an advisory covering 7 CVEs
 before 0:1.24.11-3.el10_1
0:1.24.11-3.el10_1
gstreamer1-plugins-bad-free-libs
Red Hat:enterprise_linux:10.1
From an advisory covering 7 CVEs
 before 0:1.24.11-3.el10_1
0:1.24.11-3.el10_1
gstreamer1-plugins-bad-free-libs-debuginfo
Red Hat:enterprise_linux:10.1
From an advisory covering 7 CVEs
 before 0:1.24.11-3.el10_1
0:1.24.11-3.el10_1
gstreamer1-plugins-base
Red Hat:enterprise_linux:10.1
From an advisory covering 7 CVEs
 before 0:1.24.11-2.el10_1
0:1.24.11-2.el10_1
gstreamer1-plugins-base-debuginfo
Red Hat:enterprise_linux:10.1
From an advisory covering 7 CVEs
 before 0:1.24.11-2.el10_1
0:1.24.11-2.el10_1
gstreamer1-plugins-base-debugsource
Red Hat:enterprise_linux:10.1
From an advisory covering 7 CVEs
 before 0:1.24.11-2.el10_1
0:1.24.11-2.el10_1
gstreamer1-plugins-base-devel
Red Hat:enterprise_linux:10.1
From an advisory covering 7 CVEs
 before 0:1.24.11-2.el10_1
0:1.24.11-2.el10_1
gstreamer1-plugins-base-tools
Red Hat:enterprise_linux:10.1
From an advisory covering 7 CVEs
 before 0:1.24.11-2.el10_1
0:1.24.11-2.el10_1
gstreamer1-plugins-base-tools-debuginfo
Red Hat:enterprise_linux:10.1
From an advisory covering 7 CVEs
 before 0:1.24.11-2.el10_1
0:1.24.11-2.el10_1
gstreamer1-plugins-good
Red Hat:enterprise_linux:10.1
From an advisory covering 7 CVEs
 before 0:1.24.11-2.el10_1
0:1.24.11-2.el10_1
gstreamer1-plugins-good-debuginfo
Red Hat:enterprise_linux:10.1
From an advisory covering 7 CVEs
 before 0:1.24.11-2.el10_1
0:1.24.11-2.el10_1
gstreamer1-plugins-good-debugsource
Red Hat:enterprise_linux:10.1
From an advisory covering 7 CVEs
 before 0:1.24.11-2.el10_1
0:1.24.11-2.el10_1
gstreamer1-plugins-good-gtk
Red Hat:enterprise_linux:10.1
From an advisory covering 7 CVEs
 before 0:1.24.11-2.el10_1
0:1.24.11-2.el10_1
gstreamer1-plugins-good-gtk-debuginfo
Red Hat:enterprise_linux:10.1
From an advisory covering 7 CVEs
 before 0:1.24.11-2.el10_1
0:1.24.11-2.el10_1
gstreamer1-plugins-good-qt6-debuginfo
Red Hat:enterprise_linux:10.1
From an advisory covering 7 CVEs
 before 0:1.24.11-2.el10_1
0:1.24.11-2.el10_1
gstreamer1-plugins-ugly-free
Red Hat:enterprise_linux:10.1
From an advisory covering 7 CVEs
 before 0:1.24.11-2.el10_1
0:1.24.11-2.el10_1
gstreamer1-plugins-ugly-free-debuginfo
Red Hat:enterprise_linux:10.1
From an advisory covering 7 CVEs
 before 0:1.24.11-2.el10_1
0:1.24.11-2.el10_1
gstreamer1-plugins-ugly-free-debugsource
Red Hat:enterprise_linux:10.1
From an advisory covering 7 CVEs
 before 0:1.24.11-2.el10_1
0:1.24.11-2.el10_1
gstreamer1-plugins-bad-free-devel
Red Hat:enterprise_linux:10.1
From an advisory covering 7 CVEs
 before 0:1.24.11-3.el10_1
0:1.24.11-3.el10_1
gstreamer1-plugins-bad-free
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_7
0:1.22.12-5.el9_7
gstreamer1-plugins-bad-free-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_7
0:1.22.12-5.el9_7
gstreamer1-plugins-bad-free-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_7
0:1.22.12-5.el9_7
gstreamer1-plugins-bad-free-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_7
0:1.22.12-5.el9_7
gstreamer1-plugins-bad-free-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_7
0:1.22.12-5.el9_7
gstreamer1-plugins-base
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_7
0:1.22.12-5.el9_7
gstreamer1-plugins-base-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_7
0:1.22.12-5.el9_7
gstreamer1-plugins-base-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_7
0:1.22.12-5.el9_7
gstreamer1-plugins-base-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_7
0:1.22.12-5.el9_7
gstreamer1-plugins-base-tools
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_7
0:1.22.12-5.el9_7
gstreamer1-plugins-base-tools-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_7
0:1.22.12-5.el9_7
gstreamer1-plugins-good
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_7
0:1.22.12-5.el9_7
gstreamer1-plugins-good-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_7
0:1.22.12-5.el9_7
gstreamer1-plugins-good-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_7
0:1.22.12-5.el9_7
gstreamer1-plugins-good-gtk
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_7
0:1.22.12-5.el9_7
gstreamer1-plugins-good-gtk-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_7
0:1.22.12-5.el9_7
gstreamer1-plugins-good-qt-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_7
0:1.22.12-5.el9_7
gstreamer1-plugins-ugly-free
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-4.el9_7
0:1.22.12-4.el9_7
gstreamer1-plugins-ugly-free-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-4.el9_7
0:1.22.12-4.el9_7
gstreamer1-plugins-ugly-free-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-4.el9_7
0:1.22.12-4.el9_7
gstreamer1-plugins-bad-free-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_7
0:1.22.12-5.el9_7
gstreamer1-plugins-bad-free-debugsource
Red Hat:enterprise_linux:9::crb
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_7
0:1.22.12-5.el9_7
gstreamer1-plugins-bad-free-devel
Red Hat:enterprise_linux:9::crb
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_7
0:1.22.12-5.el9_7
gstreamer1-plugins-bad-free-libs-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_7
0:1.22.12-5.el9_7
gstreamer1-plugins-bad-free
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 0:1.24.11-3.el10_0
0:1.24.11-3.el10_0
gstreamer1-plugins-bad-free-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 0:1.24.11-3.el10_0
0:1.24.11-3.el10_0
gstreamer1-plugins-bad-free-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 0:1.24.11-3.el10_0
0:1.24.11-3.el10_0
gstreamer1-plugins-bad-free-libs
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 0:1.24.11-3.el10_0
0:1.24.11-3.el10_0
gstreamer1-plugins-bad-free-libs-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 0:1.24.11-3.el10_0
0:1.24.11-3.el10_0
gstreamer1-plugins-base
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 0:1.24.11-1.el10_0.1
0:1.24.11-1.el10_0.1
gstreamer1-plugins-base-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 0:1.24.11-1.el10_0.1
0:1.24.11-1.el10_0.1
gstreamer1-plugins-base-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 0:1.24.11-1.el10_0.1
0:1.24.11-1.el10_0.1
gstreamer1-plugins-base-devel
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 0:1.24.11-1.el10_0.1
0:1.24.11-1.el10_0.1
gstreamer1-plugins-base-tools
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 0:1.24.11-1.el10_0.1
0:1.24.11-1.el10_0.1
gstreamer1-plugins-base-tools-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 0:1.24.11-1.el10_0.1
0:1.24.11-1.el10_0.1
gstreamer1-plugins-good
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 0:1.24.11-1.el10_0.2
0:1.24.11-1.el10_0.2
gstreamer1-plugins-good-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 0:1.24.11-1.el10_0.2
0:1.24.11-1.el10_0.2
gstreamer1-plugins-good-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 0:1.24.11-1.el10_0.2
0:1.24.11-1.el10_0.2
gstreamer1-plugins-good-gtk
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 0:1.24.11-1.el10_0.2
0:1.24.11-1.el10_0.2
gstreamer1-plugins-good-gtk-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 0:1.24.11-1.el10_0.2
0:1.24.11-1.el10_0.2
gstreamer1-plugins-good-qt6-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 0:1.24.11-1.el10_0.2
0:1.24.11-1.el10_0.2
gstreamer1-plugins-ugly-free
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 0:1.24.11-1.el10_0.1
0:1.24.11-1.el10_0.1
gstreamer1-plugins-ugly-free-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 0:1.24.11-1.el10_0.1
0:1.24.11-1.el10_0.1
gstreamer1-plugins-ugly-free-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 0:1.24.11-1.el10_0.1
0:1.24.11-1.el10_0.1
gstreamer1-plugins-bad-free-devel
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 0:1.24.11-3.el10_0
0:1.24.11-3.el10_0
gstreamer1-plugins-bad-free
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_6
0:1.22.12-5.el9_6
gstreamer1-plugins-bad-free-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_6
0:1.22.12-5.el9_6
gstreamer1-plugins-bad-free-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_6
0:1.22.12-5.el9_6
gstreamer1-plugins-bad-free-libs
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_6
0:1.22.12-5.el9_6
gstreamer1-plugins-bad-free-libs-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_6
0:1.22.12-5.el9_6
gstreamer1-plugins-base
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_6
0:1.22.12-5.el9_6
gstreamer1-plugins-base-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_6
0:1.22.12-5.el9_6
gstreamer1-plugins-base-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_6
0:1.22.12-5.el9_6
gstreamer1-plugins-base-devel
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_6
0:1.22.12-5.el9_6
gstreamer1-plugins-base-tools
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_6
0:1.22.12-5.el9_6
gstreamer1-plugins-base-tools-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_6
0:1.22.12-5.el9_6
gstreamer1-plugins-good
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_6
0:1.22.12-5.el9_6
gstreamer1-plugins-good-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_6
0:1.22.12-5.el9_6
gstreamer1-plugins-good-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_6
0:1.22.12-5.el9_6
gstreamer1-plugins-good-gtk
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_6
0:1.22.12-5.el9_6
gstreamer1-plugins-good-gtk-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_6
0:1.22.12-5.el9_6
gstreamer1-plugins-good-qt-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_6
0:1.22.12-5.el9_6
gstreamer1-plugins-ugly-free
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-4.el9_6
0:1.22.12-4.el9_6
gstreamer1-plugins-ugly-free-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-4.el9_6
0:1.22.12-4.el9_6
gstreamer1-plugins-ugly-free-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 7 CVEs
 before 0:1.22.12-4.el9_6
0:1.22.12-4.el9_6
gstreamer1-plugins-bad-free-debuginfo
Red Hat:rhel_eus:9.6::crb
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_6
0:1.22.12-5.el9_6
gstreamer1-plugins-bad-free-debugsource
Red Hat:rhel_eus:9.6::crb
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_6
0:1.22.12-5.el9_6
gstreamer1-plugins-bad-free-devel
Red Hat:rhel_eus:9.6::crb
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_6
0:1.22.12-5.el9_6
gstreamer1-plugins-bad-free-libs-debuginfo
Red Hat:rhel_eus:9.6::crb
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_6
0:1.22.12-5.el9_6
gstreamer1-plugins-ugly-free
Rocky Linux:10
From an advisory covering 7 CVEs
 before 0:1.26.7-2.el10_2
0:1.26.7-2.el10_2
gstreamer1-plugins-good
Rocky Linux:10
From an advisory covering 7 CVEs
 before 0:1.26.7-2.el10_2
0:1.26.7-2.el10_2
gstreamer1-plugins-base
Rocky Linux:10
From an advisory covering 7 CVEs
 before 0:1.26.7-2.el10_2
0:1.26.7-2.el10_2
gstreamer1-plugins-bad-free
Rocky Linux:10
From an advisory covering 7 CVEs
 before 0:1.26.7-2.el10_2
0:1.26.7-2.el10_2
gstreamer1-plugins-bad-free
Rocky Linux:9
From an advisory covering 7 CVEs
 before 0:1.22.12-7.el9_8
0:1.22.12-7.el9_8
gstreamer1-plugins-base
Rocky Linux:9
From an advisory covering 7 CVEs
 before 0:1.22.12-8.el9_8
0:1.22.12-8.el9_8
gstreamer1-plugins-good
Rocky Linux:9
From an advisory covering 7 CVEs
 before 0:1.22.12-7.el9_8
0:1.22.12-7.el9_8
gstreamer1-plugins-ugly-free
Rocky Linux:9
From an advisory covering 7 CVEs
 before 0:1.22.12-6.el9_8
0:1.22.12-6.el9_8
gstreamer1-plugins-good
Rocky Linux:10
From an advisory covering 7 CVEs
 before 0:1.24.11-2.el10_1
0:1.24.11-2.el10_1
gstreamer1-plugins-bad-free
Rocky Linux:10
From an advisory covering 7 CVEs
 before 0:1.24.11-3.el10_1
0:1.24.11-3.el10_1
gstreamer1-plugins-ugly-free
Rocky Linux:10
From an advisory covering 7 CVEs
 before 0:1.24.11-2.el10_1
0:1.24.11-2.el10_1
gstreamer1-plugins-base
Rocky Linux:10
From an advisory covering 7 CVEs
 before 0:1.24.11-2.el10_1
0:1.24.11-2.el10_1
gstreamer1-plugins-bad-free
Rocky Linux:9
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_7
0:1.22.12-5.el9_7
gstreamer1-plugins-base
Rocky Linux:9
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_7
0:1.22.12-5.el9_7
gstreamer1-plugins-good
Rocky Linux:9
From an advisory covering 7 CVEs
 before 0:1.22.12-5.el9_7
0:1.22.12-5.el9_7
gstreamer1-plugins-ugly-free
Rocky Linux:9
From an advisory covering 7 CVEs
 before 0:1.22.12-4.el9_7
0:1.22.12-4.el9_7
gstreamer-plugins-ugly
SUSE:Linux Enterprise Workstation Extension 15 SP7
From an advisory covering 2 CVEs
 before 1.24.0-150600.3.5.1
1.24.0-150600.3.5.1
gstreamer-plugins-ugly
openSUSE:Leap 15.6
From an advisory covering 2 CVEs
 before 1.24.0-150600.3.5.1
1.24.0-150600.3.5.1
gstreamer-plugins-ugly
SUSE:Linux Enterprise Server 16.0
From an advisory covering 2 CVEs
 before 1.26.7-160000.2.1
1.26.7-160000.2.1
gstreamer-plugins-ugly
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 1.26.7-160000.2.1
1.26.7-160000.2.1
gst-plugins-ugly1.0
Ubuntu:Pro:16.04:LTS
 before 1.8.3-1ubuntu0.1+esm2, plus listed versions
1.6.0-1ubuntu11.6.1-1ubuntu11.6.2-1ubuntu11.7.1-1ubuntu11.7.2-1ubuntu1
Show 7 moreShow less
1.7.90-1ubuntu11.7.91-1ubuntu11.8.0-1ubuntu11.8.1-1ubuntu0.11.8.2-1ubuntu0.11.8.3-1ubuntu0.11.8.3-1ubuntu0.1+esm1
1.8.3-1ubuntu0.1+esm2
gst-plugins-ugly1.0
Ubuntu:Pro:18.04:LTS
 before 1.14.5-0ubuntu1~18.04.1+esm1, plus listed versions
1.12.3-11.12.3-1build11.12.4-11.12.4-1build11.13.1-1
Show 5 moreShow less
1.13.91-11.14.0-11.14.1-1~ubuntu18.04.11.14.4-1~ubuntu18.04.11.14.5-0ubuntu1~18.04.1
1.14.5-0ubuntu1~18.04.1+esm1
gst-plugins-ugly1.0
Ubuntu:Pro:20.04:LTS
 before 1.16.2-2ubuntu0.1~esm1, plus listed versions
1.16.1-11.16.1-1build11.16.2-11.16.2-21.16.2-2build1
1.16.2-2ubuntu0.1~esm1
gst-plugins-ugly1.0
Ubuntu:Pro:22.04:LTS
 before 1.20.1-1ubuntu0.1~esm1, plus listed versions
1.18.5-11.20.0-11.20.0-1build11.20.1-1
1.20.1-1ubuntu0.1~esm1
gst-plugins-ugly1.0
Ubuntu:Pro:24.04:LTS
 before 1.24.1-1ubuntu0.1~esm1, plus listed versions
1.22.5-11.22.6-11.22.7-11.22.8-11.22.10-11.24.1-11.24.1-1build1
1.24.1-1ubuntu0.1~esm1
gst-plugins-ugly1.0
Ubuntu:25.10
 All versions, plus listed versions
1.26.0-11.26.1-11.26.2-11.26.3-11.26.3-3
Show 4 moreShow less
1.26.3-41.26.4-11.26.5-11.26.6-1
 None known
gst-plugins-ugly1.0
Ubuntu:Pro:16.04:LTS
From an advisory covering 7 CVEs
 before 1.8.3-1ubuntu0.1+esm2, plus listed versions
1.6.0-1ubuntu11.6.1-1ubuntu11.6.2-1ubuntu11.7.1-1ubuntu11.7.2-1ubuntu1
Show 7 moreShow less
1.7.90-1ubuntu11.7.91-1ubuntu11.8.0-1ubuntu11.8.1-1ubuntu0.11.8.2-1ubuntu0.11.8.3-1ubuntu0.11.8.3-1ubuntu0.1+esm1
1.8.3-1ubuntu0.1+esm2
gst-plugins-ugly1.0
Ubuntu:Pro:18.04:LTS
From an advisory covering 7 CVEs
 before 1.14.5-0ubuntu1~18.04.1+esm1, plus listed versions
1.12.3-11.12.3-1build11.12.4-11.12.4-1build11.13.1-1
Show 5 moreShow less
1.13.91-11.14.0-11.14.1-1~ubuntu18.04.11.14.4-1~ubuntu18.04.11.14.5-0ubuntu1~18.04.1
1.14.5-0ubuntu1~18.04.1+esm1
gst-plugins-ugly1.0
Ubuntu:Pro:20.04:LTS
From an advisory covering 7 CVEs
 before 1.16.2-2ubuntu0.1~esm1, plus listed versions
1.16.1-11.16.1-1build11.16.2-11.16.2-21.16.2-2build1
1.16.2-2ubuntu0.1~esm1
gst-plugins-ugly1.0
Ubuntu:Pro:22.04:LTS
From an advisory covering 7 CVEs
 before 1.20.1-1ubuntu0.1~esm1, plus listed versions
1.18.5-11.20.0-11.20.0-1build11.20.1-1
1.20.1-1ubuntu0.1~esm1
gst-plugins-ugly1.0
Ubuntu:Pro:24.04:LTS
From an advisory covering 7 CVEs
 before 1.24.1-1ubuntu0.1~esm1, plus listed versions
1.22.5-11.22.6-11.22.7-11.22.8-11.22.10-11.24.1-11.24.1-1build1
1.24.1-1ubuntu0.1~esm1
gst-plugins-ugly1.0
Ubuntu:Pro:26.04:LTS
From an advisory covering 7 CVEs
 before 1.28.2-1ubuntu0.1~esm1, plus listed versions
1.26.6-11.26.7-1build11.27.2-11.27.90-11.28.0-11.28.1-11.28.2-1
1.28.2-1ubuntu0.1~esm1
gstreamer-plugins-ugly
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 1.26.7-160000.2.1
1.26.7-160000.2.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-2922 is a high vulnerability (CVSS 7.8) in Gstreamer, published March 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. Fixed in gst-plugins-ugly1.0 1.22.0-2+deb12u2.

References

Show 87 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open