{"id":"CVE-2026-52722","aliases":["ALSA-2026:36749","ALSA-2026:36834","ALSA-2026:37130","CLSA-2026-1784117778","CLSA-2026-1786960802","CLSA-2026-1787222051","DEBIAN-CVE-2026-52722","EUVD-2026-36804","GHSA-cj3w-jxwm-h5h8","OESA-2026-4828","OESA-2026-4829","OESA-2026-4830","OESA-2026-4831","RHSA-2026:36749","RHSA-2026:36834","RHSA-2026:37130","RHSA-2026:47069","RHSA-2026:47070","RHSA-2026:47071","RHSA-2026:47075","RHSA-2026:47076","RHSA-2026:47176","RHSA-2026:47717","RHSA-2026:47718","RHSA-2026:49517","RLSA-2026:36749","RLSA-2026:36834","RLSA-2026:37130","SUSE-SU-2026:22752-1","SUSE-SU-2026:22817-1","SUSE-SU-2026:3058-1","SUSE-SU-2026:3125-1","SUSE-SU-2026:3133-1","SUSE-SU-2026:3299-1","UBUNTU-CVE-2026-52722","openSUSE-SU-2026:21370-1"],"status":"published","title":"Gstreamer1-plugins-bad-free: gstreamer: signed integer overflow in vmnc decoder cursor payload handling","description":"A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a specially crafted VMnc file, potentially causing a crash or information disclosure.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00392,"percentile":0.33818,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2026-06-15T19:15:23Z","modified":"2026-11-11T12:45:11Z","fixes":[{"ecosystem":"Debian:13","package":"gst-plugins-bad1.0","fixed_in":["1.26.2-3+deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gst-plugins-bad1.0","fixed_in":["1.28.5-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"gstreamer1-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-2.el10_2.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"gstreamer1-plugins-bad-free-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-2.el10_2.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"gstreamer1-plugins-bad-free-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-2.el10_2.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gstreamer1-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-7.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gstreamer1-plugins-bad-free-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-7.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gstreamer1-plugins-bad-free-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-7.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"gstreamer1-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-8.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"gstreamer1-plugins-bad-free-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-8.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gstreamer1-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-4.el9_6.tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gstreamer1-plugins-bad-free-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-4.el9_6.tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gstreamer1-plugins-bad-free-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-4.el9_6.tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gstreamer1-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-6.el9_2.tuxcare.els6"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gstreamer1-plugins-bad-free-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-6.el9_2.tuxcare.els6"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"gstreamer1-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-4.el7_9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"gstreamer1-plugins-bad-free-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-4.el7_9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"gstreamer1-plugins-bad-free-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-4.el7_9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:13","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-3+deb13u3"}]}],"versions":["1.26.2-3","1.26.2-3+deb13u1","1.26.2-3+deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.5-1"}]}],"versions":["1.26.10-1","1.26.10-2","1.26.2-3","1.26.3-1","1.26.4-1","1.26.5-1","1.26.5-2","1.26.6-1","1.26.6-2","1.26.6-3","1.26.6-4","1.26.6-5","1.26.7-1","1.26.7-2","1.26.8-1","1.26.9-1","1.27.1-1","1.27.2-1","1.27.50-1","1.27.90-1","1.27.90-2","1.27.90-3","1.28.0-1","1.28.1-1","1.28.1-2","1.28.1-3","1.28.2-1","1.28.2-2","1.28.3-1","1.28.4-1"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"gstreamer1-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-20.oe2203sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"gstreamer1-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-20.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"gstreamer1-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-20.oe2403sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"gstreamer1-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-20.oe2403sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"gstreamer1-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.7-2.el10_2.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"gstreamer1-plugins-bad-free-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.7-2.el10_2.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"gstreamer1-plugins-bad-free-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.7-2.el10_2.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"gstreamer1-plugins-bad-free-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.7-2.el10_2.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"gstreamer1-plugins-bad-free-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.7-2.el10_2.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"gstreamer1-plugins-bad-free-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.7-2.el10_2.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-7.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-bad-free-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-7.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-bad-free-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-7.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-bad-free-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-7.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-bad-free-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-7.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"gstreamer1-plugins-bad-free-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-7.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"gstreamer1-plugins-bad-free-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-7.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"gstreamer1-plugins-bad-free-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-7.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"gstreamer1-plugins-bad-free-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-7.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-8.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-bad-free-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-8.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-bad-free-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-8.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gstreamer1-plugins-bad-free-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-8.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gstreamer1-plugins-bad-free-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-8.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gstreamer1-plugins-bad-free-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-8.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"gstreamer1-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-9.el9_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"gstreamer1-plugins-bad-free-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-9.el9_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"gstreamer1-plugins-bad-free-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-9.el9_2.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gstreamer1-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-5.el9_6.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gstreamer1-plugins-bad-free-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-5.el9_6.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gstreamer1-plugins-bad-free-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-5.el9_6.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gstreamer1-plugins-bad-free-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-5.el9_6.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gstreamer1-plugins-bad-free-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-5.el9_6.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"gstreamer1-plugins-bad-free-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-5.el9_6.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"gstreamer1-plugins-bad-free-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-5.el9_6.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"gstreamer1-plugins-bad-free-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-5.el9_6.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"gstreamer1-plugins-bad-free-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-5.el9_6.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gstreamer1-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-6.el9_4.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gstreamer1-plugins-bad-free-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-6.el9_4.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gstreamer1-plugins-bad-free-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-6.el9_4.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"gstreamer1-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"gstreamer1-plugins-bad-free-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"gstreamer1-plugins-bad-free-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"gstreamer1-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"gstreamer1-plugins-bad-free-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"gstreamer1-plugins-bad-free-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"gstreamer1-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"gstreamer1-plugins-bad-free-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"gstreamer1-plugins-bad-free-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"gstreamer1-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"gstreamer1-plugins-bad-free-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"gstreamer1-plugins-bad-free-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"gstreamer1-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.4-6.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"gstreamer1-plugins-bad-free-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.4-6.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"gstreamer1-plugins-bad-free-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.4-6.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"gstreamer1-plugins-bad-free-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.4-6.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gstreamer1-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.11-3.el10_0.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gstreamer1-plugins-bad-free-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.11-3.el10_0.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gstreamer1-plugins-bad-free-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.11-3.el10_0.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gstreamer1-plugins-bad-free-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.11-3.el10_0.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gstreamer1-plugins-bad-free-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.11-3.el10_0.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gstreamer1-plugins-bad-free-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.11-3.el10_0.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"gstreamer1-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"gstreamer1-plugins-bad-free-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"gstreamer1-plugins-bad-free-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"gstreamer1-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"gstreamer1-plugins-bad-free-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"gstreamer1-plugins-bad-free-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"gstreamer-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.23-25.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"gstreamer-plugins-bad-free-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.23-25.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"gstreamer-plugins-bad-free-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.23-25.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"gstreamer-plugins-bad-free-devel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.23-25.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"gstreamer1-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.7-2.el10_2.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"gstreamer1-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-7.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"gstreamer1-plugins-bad-free","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-8.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.4.9.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.4.9.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.4.9.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.4.9.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.4.9.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.3.34.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.3.34.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.3.34.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.3.34.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.29.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.29.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.29.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.29.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-18.21.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-18.21.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.0-3ubuntu5","1.2.1-1ubuntu1","1.2.1-1ubuntu2","1.2.2-1ubuntu1","1.2.2-1ubuntu2","1.2.2-1ubuntu4","1.2.3-1ubuntu1","1.2.3-1ubuntu2","1.2.4-1~ubuntu1","1.2.4-1~ubuntu1.1","1.2.4-1~ubuntu1.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.0-1ubuntu1","1.6.1-1ubuntu1","1.6.2-1ubuntu1","1.7.1-1ubuntu1","1.7.1-1ubuntu3","1.7.1-1ubuntu4","1.7.2-1ubuntu1","1.7.90-1ubuntu2","1.7.91-1ubuntu1","1.8.0-1ubuntu1","1.8.1-1ubuntu0.1","1.8.2-1ubuntu0.1","1.8.2-1ubuntu0.2","1.8.3-1ubuntu0.2","1.8.3-1ubuntu0.2+esm1","1.8.3-1ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.12.3-1ubuntu1","1.12.3-1ubuntu2","1.12.3-2ubuntu1","1.12.4-2ubuntu1","1.12.4-2ubuntu2","1.13.1-1ubuntu1","1.13.91-1ubuntu1","1.14.0-1ubuntu1","1.14.1-1ubuntu1~ubuntu18.04.1","1.14.4-1ubuntu1~ubuntu18.04.1","1.14.5-0ubuntu1~18.04.1","1.14.5-0ubuntu1~18.04.1+esm1","1.14.5-0ubuntu1~18.04.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.1-1ubuntu1","1.16.1-1ubuntu3","1.16.1-1ubuntu4","1.16.1-1ubuntu5","1.16.1-1ubuntu6","1.16.1-1ubuntu8","1.16.2-1ubuntu1","1.16.2-1ubuntu2","1.16.2-2ubuntu1","1.16.2-2.1ubuntu1","1.16.3-0ubuntu1","1.16.3-0ubuntu1.1","1.16.3-0ubuntu1.1+esm1","1.16.3-0ubuntu1.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.5-1ubuntu1","1.18.5-1ubuntu3","1.20.0-2ubuntu2","1.20.1-1ubuntu2","1.20.3-0ubuntu1","1.20.3-0ubuntu1.1","1.20.3-0ubuntu1.1+esm2","1.20.3-0ubuntu1.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.4-1ubuntu1","1.22.4-1ubuntu2","1.22.4-1ubuntu4","1.22.9-2ubuntu1","1.24.0-1ubuntu3","1.24.0-1ubuntu4","1.24.2-1ubuntu4","1.24.2-1ubuntu4+esm1","1.24.2-1ubuntu4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.0-1ubuntu2","1.26.2-1ubuntu1","1.26.3-1ubuntu1","1.26.4-1ubuntu1","1.26.5-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.28.2-1ubuntu1","1.28.2-1ubuntu2","1.28.4-1ubuntu1","1.28.4-1ubuntu2","1.28.6-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.5-1ubuntu2","1.27.2-1ubuntu1","1.27.90-1ubuntu2","1.28.0-1ubuntu2","1.28.1-2ubuntu2","1.28.1-2ubuntu3","1.28.2-1ubuntu1","1.28.2-1ubuntu1.1","1.28.2-1ubuntu1.2"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.3.1"}]}],"bundled":9}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.0 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 7 extended lifecycle support"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 telecommunications update service"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.2 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.6 extended update support"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:36749","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36834","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37130","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47069","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47070","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47071","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47075","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47076","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47176","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47717","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47718","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:49517","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-52722","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486733","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5107","tags":["article","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52722.json","tags":["x_sadp-csaf-vex"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52722","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cj3w-jxwm-h5h8"},{"url":"https://access.redhat.com/security/cve/CVE-2026-52718","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-52719","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-52720","tags":["report"]},{"url":"https://bugzilla.redhat.com/2486328","tags":["report"]},{"url":"https://bugzilla.redhat.com/2486353","tags":["report"]},{"url":"https://bugzilla.redhat.com/2486731","tags":["report"]},{"url":"https://bugzilla.redhat.com/2486733","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-36749.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-36834.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-37130.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1784117778.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52718","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52719","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52720","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1786960802.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1787222051.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-52722","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4828","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19387","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4829","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4830","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4831","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486328","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486353","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486731","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36749.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-52718","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5103","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-52719","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5104","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-52720","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5105","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-52722","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36834.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_37130.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47069.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47070.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47071.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47075.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47076.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47176.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47717.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47718.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49517.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:36749","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:36834","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:37130","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622752-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268168","tags":["report"]},{"url":"https://bugzilla.suse.com/1268172","tags":["report"]},{"url":"https://bugzilla.suse.com/1268406","tags":["report"]},{"url":"https://bugzilla.suse.com/1268408","tags":["report"]},{"url":"https://bugzilla.suse.com/1268410","tags":["report"]},{"url":"https://bugzilla.suse.com/1268872","tags":["report"]},{"url":"https://bugzilla.suse.com/1268971","tags":["report"]},{"url":"https://bugzilla.suse.com/1271051","tags":["report"]},{"url":"https://bugzilla.suse.com/1271168","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59692","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622817-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263058-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263125-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263133-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263299-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-52722","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-52722","title":"Gstreamer1-plugins-bad-free: gstreamer: signed integer overflow in vmnc decoder cursor payload handling","description":"A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a specially crafted VMnc file, potentially causing a crash or information disclosure.","status":"published","published":"2026-06-15T19:15:23.846Z","modified":"2026-11-04T22:43:50.151Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-190","CWE-190"],"updated_at":"2026-11-04T23:40:09.798467Z"}],"euvd":[{"id":"EUVD-2026-36804","description":"A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a specially crafted VMnc file, potentially causing a crash or information disclosure.","status":"published","published":"2026-06-15T19:15:23Z","modified":"2026-11-04T22:43:50Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T00:47:41.139684Z"}],"ghsa":[{"id":"GHSA-cj3w-jxwm-h5h8","title":"A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc...","description":"A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a specially crafted VMnc file, potentially causing a crash or information disclosure.","status":"published","published":"2026-06-15T21:30:42Z","modified":"2026-08-03T12:32:36Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:10:02.233759Z"}],"nvd":[{"id":"CVE-2026-52722","description":"A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a specially crafted VMnc file, potentially causing a crash or information disclosure.","status":"published","published":"2026-06-15T20:16:32.83Z","modified":"2026-11-04T23:17:46.113Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-190"],"updated_at":"2026-11-05T01:45:09.958441Z"}],"osv":[{"id":"DEBIAN-CVE-2026-52722","description":"A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a specially crafted VMnc file, potentially causing a crash or information disclosure.","status":"published","published":"2026-06-15T20:16:32.83Z","modified":"2026-11-05T09:47:38.281684614Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T13:31:24.64316Z"},{"id":"OESA-2026-4828","title":"gstreamer1-plugins-bad-free security update","description":"GStreamer is a pipeline-based multi media framework that links together a wide variety of media processing systems to complete complex workflows, based on graphs of filters which operate on media data. This package contains plug-ins that are not tested well enough yet, or the code is not of good enough quality.\r\n\r\nSecurity Fix(es):\n\nA heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. This can lead to application crash, denial of service, memory corruption, or potentially arbitrary code execution when untrusted media is processed.(CVE-2026-19387)\n\nA heap buffer overflow vulnerability was found in GStreamer\u0026apos;s librfb (RFB/VNC client). The rectangle bounds check incorrectly validates area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebuffer. A remote attacker could set up a malicious VNC server and trick a user into connecting, resulting in an out-of-bounds heap write that could lead to code execution or a crash.(CVE-2026-52720)\n\nA signed integer overflow vulnerability was found in GStreamer\u0026apos;s VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a specially crafted VMnc file, potentially causing a crash or information disclosure.(CVE-2026-52722)","status":"published","published":"2026-11-11T12:26:36Z","modified":"2026-11-11T12:45:10.165756667Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"OESA-2026-4829","title":"gstreamer1-plugins-bad-free security update","description":"GStreamer is a pipeline-based multi media framework that links together a wide variety of media processing systems to complete complex workflows, based on graphs of filters which operate on media data. This package contains plug-ins that are not tested well enough yet, or the code is not of good enough quality.\r\n\r\nSecurity Fix(es):\n\nA heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. This can lead to application crash, denial of service, memory corruption, or potentially arbitrary code execution when untrusted media is processed.(CVE-2026-19387)\n\nA heap buffer overflow vulnerability was found in GStreamer\u0026apos;s librfb (RFB/VNC client). The rectangle bounds check incorrectly validates area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebuffer. A remote attacker could set up a malicious VNC server and trick a user into connecting, resulting in an out-of-bounds heap write that could lead to code execution or a crash.(CVE-2026-52720)\n\nA signed integer overflow vulnerability was found in GStreamer\u0026apos;s VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a specially crafted VMnc file, potentially causing a crash or information disclosure.(CVE-2026-52722)","status":"published","published":"2026-11-11T12:26:37Z","modified":"2026-11-11T12:45:11.665701807Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"OESA-2026-4830","title":"gstreamer1-plugins-bad-free security update","description":"GStreamer is a pipeline-based multi media framework that links together a wide variety of media processing systems to complete complex workflows, based on graphs of filters which operate on media data. This package contains plug-ins that are not tested well enough yet, or the code is not of good enough quality.\r\n\r\nSecurity Fix(es):\n\nA heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. This can lead to application crash, denial of service, memory corruption, or potentially arbitrary code execution when untrusted media is processed.(CVE-2026-19387)\n\nA heap buffer overflow vulnerability was found in GStreamer\u0026apos;s librfb (RFB/VNC client). The rectangle bounds check incorrectly validates area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebuffer. A remote attacker could set up a malicious VNC server and trick a user into connecting, resulting in an out-of-bounds heap write that could lead to code execution or a crash.(CVE-2026-52720)\n\nA signed integer overflow vulnerability was found in GStreamer\u0026apos;s VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a specially crafted VMnc file, potentially causing a crash or information disclosure.(CVE-2026-52722)","status":"published","published":"2026-11-11T12:26:37Z","modified":"2026-11-11T12:45:11.074427882Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"OESA-2026-4831","title":"gstreamer1-plugins-bad-free security update","description":"GStreamer is a pipeline-based multi media framework that links together a wide variety of media processing systems to complete complex workflows, based on graphs of filters which operate on media data. This package contains plug-ins that are not tested well enough yet, or the code is not of good enough quality.\r\n\r\nSecurity Fix(es):\n\nA heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. This can lead to application crash, denial of service, memory corruption, or potentially arbitrary code execution when untrusted media is processed.(CVE-2026-19387)\n\nA heap buffer overflow vulnerability was found in GStreamer\u0026apos;s librfb (RFB/VNC client). The rectangle bounds check incorrectly validates area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebuffer. A remote attacker could set up a malicious VNC server and trick a user into connecting, resulting in an out-of-bounds heap write that could lead to code execution or a crash.(CVE-2026-52720)\n\nA signed integer overflow vulnerability was found in GStreamer\u0026apos;s VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a specially crafted VMnc file, potentially causing a crash or information disclosure.(CVE-2026-52722)","status":"published","published":"2026-11-11T12:26:38Z","modified":"2026-11-11T12:45:11.076970584Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"RHSA-2026:36749","title":"Red Hat Security Advisory: gstreamer1-plugins-bad-free security update","status":"published","published":"2026-07-09T10:12:50Z","modified":"2026-08-04T10:23:02Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:36834","title":"Red Hat Security Advisory: gstreamer1-plugins-bad-free security update","status":"published","published":"2026-07-09T10:12:59Z","modified":"2026-08-04T10:23:06Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:37130","title":"Red Hat Security Advisory: gstreamer1-plugins-bad-free security update","status":"published","published":"2026-07-09T10:13:07Z","modified":"2026-08-04T10:23:12Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:47069","title":"Red Hat Security Advisory: gstreamer1-plugins-bad-free security update","status":"published","published":"2026-07-29T10:11:32Z","modified":"2026-08-04T10:25:38Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:47070","title":"Red Hat Security Advisory: gstreamer1-plugins-bad-free security update","status":"published","published":"2026-07-29T10:11:32Z","modified":"2026-08-04T10:25:38Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:47071","title":"Red Hat Security Advisory: gstreamer1-plugins-bad-free security update","status":"published","published":"2026-07-29T10:11:33Z","modified":"2026-08-04T10:25:39Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:47075","title":"Red Hat Security Advisory: gstreamer1-plugins-bad-free security update","status":"published","published":"2026-07-29T10:11:33Z","modified":"2026-08-04T10:25:40Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:47076","title":"Red Hat Security Advisory: gstreamer1-plugins-bad-free security update","status":"published","published":"2026-07-29T10:11:34Z","modified":"2026-08-04T10:25:41Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:47176","title":"Red Hat Security Advisory: gstreamer1-plugins-bad-free security update","status":"published","published":"2026-07-29T10:11:40Z","modified":"2026-08-04T10:25:48Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:47717","title":"Red Hat Security Advisory: gstreamer1-plugins-bad-free security update","status":"published","published":"2026-07-30T10:17:43Z","modified":"2026-08-04T10:26:00Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:47718","title":"Red Hat Security Advisory: gstreamer1-plugins-bad-free security update","status":"published","published":"2026-07-30T10:17:44Z","modified":"2026-08-04T10:26:01Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:49517","title":"Red Hat Security Advisory: gstreamer-plugins-bad-free security update","status":"published","published":"2026-08-04T10:26:44Z","modified":"2026-08-04T10:33:07.942562035Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RLSA-2026:36749","title":"Important: gstreamer1-plugins-bad-free security update","description":"GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.\n\nSecurity Fix(es):\n\n* gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion (CVE-2026-52718)\n\n* gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder (CVE-2026-52719)\n\n* gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720)\n\n* gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-10T12:05:34.876921Z","modified":"2026-07-10T12:30:04.74764255Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:36834","title":"Important: gstreamer1-plugins-bad-free security update","description":"GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.\n\nSecurity Fix(es):\n\n* gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion (CVE-2026-52718)\n\n* gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder (CVE-2026-52719)\n\n* gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720)\n\n* gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-10T12:03:38.827258Z","modified":"2026-07-10T12:30:04.655110326Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:37130","title":"Important: gstreamer1-plugins-bad-free security update","description":"GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.\n\nSecurity Fix(es):\n\n* gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720)\n\n* gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-10T06:00:28.519192Z","modified":"2026-07-10T06:30:05.339821037Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2026-52722","description":"A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a specially crafted VMnc file, potentially causing a crash or information disclosure.","status":"published","published":"2026-06-15T20:16:00Z","modified":"2026-10-17T12:59:01.021523724Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"ALSA-2026:36749","title":"Important: gstreamer1-plugins-bad-free security update","description":"GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.  \n\nSecurity Fix(es):  \n\n  * gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion (CVE-2026-52718)\n  * gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder (CVE-2026-52719)\n  * gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720)\n  * gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-08T00:00:00Z","modified":"2026-10-29T11:30:30.730070597Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:36834","title":"Important: gstreamer1-plugins-bad-free security update","description":"GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.  \n\nSecurity Fix(es):  \n\n  * gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion (CVE-2026-52718)\n  * gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder (CVE-2026-52719)\n  * gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720)\n  * gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-08T00:00:00Z","modified":"2026-10-29T11:32:35.395236986Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:37130","title":"Important: gstreamer1-plugins-bad-free security update","description":"GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.  \n\nSecurity Fix(es):  \n\n  * gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720)\n  * gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-09T00:00:00Z","modified":"2026-10-29T11:02:24.724133384Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"CLSA-2026-1784117778","title":"gstreamer1-plugins-bad-free: Fix of 4 CVEs","description":"- CVE-2026-52718: fix av1parser bytes/bits confusion when parsing tile data size\n- CVE-2026-52719: fix vajpegdecoder out-of-bounds read on invalid JPEG segment length\n- CVE-2026-52720: fix librfb framebuffer rectangle bounds check (dimensions not area)\n- CVE-2026-52722: fix vmnc signed integer overflow in cursor dimension arithmetic","status":"published","published":"2026-07-15T12:16:35Z","modified":"2026-10-26T09:31:16.072612533Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1786960802","title":"gstreamer1-plugins-bad-free: Fix of 2 CVEs","description":"- CVE-2026-52722: fix signed integer overflow in VMnc decoder cursor\n  payload size arithmetic that bypassed a rectangle length check\n- CVE-2026-52720: fix heap buffer overflow in librfb by validating\n  framebuffer update rectangle dimensions against the framebuffer size","status":"published","published":"2026-08-17T10:00:13Z","modified":"2026-10-26T09:43:25.760482944Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787222051","title":"gstreamer1-plugins-bad-free: Fix of 2 CVEs","description":"- CVE-2026-52720: fix heap buffer overflow in librfb by clipping framebuffer update rectangles to the framebuffer size\n- CVE-2026-52722: fix signed integer overflow in VMnc decoder cursor payload size arithmetic, preventing out-of-bounds reads","status":"published","published":"2026-08-22T10:36:24Z","modified":"2026-10-26T09:31:42.702744099Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"openSUSE-SU-2026:21370-1","title":"Security update for gstreamer-plugins-bad","description":"This update for gstreamer-plugins-bad fixes the following issues\n\n- CVE-2026-12891: unchecked aspect_ratio_idc value used as an array index in the H.266 parser could cause a global out-\n  of-bounds read (bsc#1268872).\n- CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser (bsc#1268971).\n- CVE-2026-14935: webrtcbin accepts remote SDP without a=fingerprint due to inverted presence check (bsc#1271051).\n- CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write\n  (bsc#1268406).\n- CVE-2026-52721: crafted PCAP records during IPv4 or TCP header parsing could cause an out-of-bounds read\n  (bsc#1268408).\n- CVE-2026-52722: crafted VMnc stream with large cursor dimensions can overflow signed integer (bsc#1268410).\n- CVE-2026-53701: multi-slice-in-tile partitions without slice index bounds checks could trigger an out-of-bounds write\n  (bsc#1268172).\n- CVE-2026-53702: incorrect loop bound during H.265 SEI message parsing could result in a stack buffer overflow\n  (bsc#1268168).\n- CVE-2026-59692: unvalidated peer certificate Subject DN printed during a DTLS handshake could cause a stack buffer\n  overflow (bsc#1271168).\n","status":"published","published":"2026-07-18T06:18:17Z","modified":"2026-07-22T18:25:10.908937951Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22752-1","title":"Security update for gstreamer-plugins-bad","description":"This update for gstreamer-plugins-bad fixes the following issues\n\n- CVE-2026-12891: unchecked aspect_ratio_idc value used as an array index in the H.266 parser could cause a global out-\n  of-bounds read (bsc#1268872).\n- CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser (bsc#1268971).\n- CVE-2026-14935: webrtcbin accepts remote SDP without a=fingerprint due to inverted presence check (bsc#1271051).\n- CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write\n  (bsc#1268406).\n- CVE-2026-52721: crafted PCAP records during IPv4 or TCP header parsing could cause an out-of-bounds read\n  (bsc#1268408).\n- CVE-2026-52722: crafted VMnc stream with large cursor dimensions can overflow signed integer (bsc#1268410).\n- CVE-2026-53701: multi-slice-in-tile partitions without slice index bounds checks could trigger an out-of-bounds write\n  (bsc#1268172).\n- CVE-2026-53702: incorrect loop bound during H.265 SEI message parsing could result in a stack buffer overflow\n  (bsc#1268168).\n- CVE-2026-59692: unvalidated peer certificate Subject DN printed during a DTLS handshake could cause a stack buffer\n  overflow (bsc#1271168).\n","status":"published","published":"2026-07-18T06:19:25Z","modified":"2026-07-23T18:24:19.307658597Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22817-1","title":"Security update for gstreamer-plugins-bad","description":"This update for gstreamer-plugins-bad fixes the following issues\n\n- CVE-2026-12891: unchecked aspect_ratio_idc value used as an array index in the H.266 parser could cause a global out-\n  of-bounds read (bsc#1268872).\n- CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser (bsc#1268971).\n- CVE-2026-14935: webrtcbin accepts remote SDP without a=fingerprint due to inverted presence check (bsc#1271051).\n- CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write\n  (bsc#1268406).\n- CVE-2026-52721: crafted PCAP records during IPv4 or TCP header parsing could cause an out-of-bounds read\n  (bsc#1268408).\n- CVE-2026-52722: crafted VMnc stream with large cursor dimensions can overflow signed integer (bsc#1268410).\n- CVE-2026-53701: multi-slice-in-tile partitions without slice index bounds checks could trigger an out-of-bounds write\n  (bsc#1268172).\n- CVE-2026-53702: incorrect loop bound during H.265 SEI message parsing could result in a stack buffer overflow\n  (bsc#1268168).\n- CVE-2026-59692: unvalidated peer certificate Subject DN printed during a DTLS handshake could cause a stack buffer\n  overflow (bsc#1271168).\n","status":"published","published":"2026-07-18T06:19:25Z","modified":"2026-07-28T18:24:07.725510396Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:3058-1","title":"Security update for gstreamer-plugins-bad","description":"This update for gstreamer-plugins-bad fixes the following issues\n\n- CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser (bsc#1268971).\n- CVE-2026-14935: webrtcbin accepts remote SDP without a=fingerprint due to inverted presence check (bsc#1271051).\n- CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write\n  (bsc#1268406).\n- CVE-2026-52721: crafted PCAP records during IPv4 or TCP header parsing could cause an out-of-bounds read\n  (bsc#1268408).\n- CVE-2026-52722: crafted VMnc stream with large cursor dimensions can overflow signed integer (bsc#1268410).\n- CVE-2026-53702: incorrect loop bound during H.265 SEI message parsing could result in a stack buffer overflow\n  (bsc#1268168).\n- CVE-2026-59692: unvalidated peer certificate Subject DN printed during a DTLS handshake could cause a stack buffer\n  overflow (bsc#1271168).\n","status":"published","published":"2026-07-15T13:32:27Z","modified":"2026-07-16T10:00:14.970960709Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3125-1","title":"Security update for gstreamer-plugins-bad","description":"This update for gstreamer-plugins-bad fixes the following issues:\n\n- CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser (bsc#1268971).\n- CVE-2026-14935: webrtcbin accepts remote SDP without a=fingerprint due to inverted presence check (bsc#1271051).\n- CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write\n  (bsc#1268406).\n- CVE-2026-52721: crafted PCAP records during IPv4 or TCP header parsing could cause an out-of-bounds read\n  (bsc#1268408).\n- CVE-2026-52722: crafted VMnc stream with large cursor dimensions can overflow signed integer (bsc#1268410).\n- CVE-2026-53702: incorrect loop bound during H.265 SEI message parsing could result in a stack buffer overflow\n  (bsc#1268168).\n- CVE-2026-59692: unvalidated peer certificate Subject DN printed during a DTLS handshake could cause a stack buffer\n  overflow (bsc#1271168).\n","status":"published","published":"2026-07-20T07:01:46Z","modified":"2026-07-21T09:45:05.328112639Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3133-1","title":"Security update for gstreamer-plugins-bad","description":"This update for gstreamer-plugins-bad fixes the following issues\n\n- CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser (bsc#1268971).\n- CVE-2026-14935: webrtcbin accepts remote SDP without a=fingerprint due to inverted presence check (bsc#1271051).\n- CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write (bsc#1268406).\n- CVE-2026-52721: crafted PCAP records during IPv4 or TCP header parsing could cause an out-of-bounds read (bsc#1268408).\n- CVE-2026-52722: crafted VMnc stream with large cursor dimensions can overflow signed integer (bsc#1268410).\n- CVE-2026-53702: incorrect loop bound during H.265 SEI message parsing could result in a stack buffer overflow (bsc#1268168).\n- CVE-2026-59692: unvalidated peer certificate Subject DN printed during a DTLS handshake could cause a stack buffer overflow (bsc#1271168).\n","status":"published","published":"2026-07-20T13:58:50Z","modified":"2026-07-21T09:45:05.363420605Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3299-1","title":"Security update for gstreamer-plugins-bad","description":"This update for gstreamer-plugins-bad fixes the following issues:\n\n- CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser (bsc#1268971).\n- CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write\n  (bsc#1268406).\n- CVE-2026-52721: crafted PCAP records during IPv4 or TCP header parsing could cause an out-of-bounds read\n  (bsc#1268408).\n- CVE-2026-52722: crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic\n  (bsc#1268410).\n- CVE-2026-53702: incorrect loop bound during H.265 SEI message parsing could result in a stack buffer overflow\n  (bsc#1268168).\n- CVE-2026-59692: unvalidated peer certificate Subject DN printed during a DTLS handshake could cause a stack buffer\n  overflow (bsc#1271168).\n","status":"published","published":"2026-07-27T16:58:29Z","modified":"2026-07-28T10:00:10.490626679Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}