{"id":"CVE-2026-53705","aliases":["ALSA-2026:36675","ALSA-2026:36774","ALSA-2026:37129","CLSA-2026-1783971636","CLSA-2026-1784021188","CLSA-2026-1788514547","CLSA-2026-1790671701","CLSA-2026-1792021687","DEBIAN-CVE-2026-53705","EUVD-2026-36799","GHSA-rc6x-6x52-9whj","OESA-2026-3481","OESA-2026-3482","OESA-2026-3483","OESA-2026-3484","OESA-2026-3485","RHSA-2026:36675","RHSA-2026:36774","RHSA-2026:37129","RHSA-2026:47032","RHSA-2026:47050","RHSA-2026:47051","RHSA-2026:47052","RHSA-2026:47174","RHSA-2026:49602","RHSA-2026:49603","RHSA-2026:49604","RLSA-2026:36675","RLSA-2026:36774","RLSA-2026:37129","ROOT-OS-DEBIAN-12-CVE-2026-53705","ROOT-OS-DEBIAN-13-CVE-2026-53705","SUSE-SU-2026:2727-1","SUSE-SU-2026:2842-1","SUSE-SU-2026:2843-1","SUSE-SU-2026:2844-1","UBUNTU-CVE-2026-53705","USN-8584-1","openSUSE-SU-2026:21240-1"],"status":"published","title":"Gstreamer1-plugins-good: gstreamer: heap buffer overflow in wavpack decoder via integer overflow","description":"A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file.","severity":{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00375,"percentile":0.31733,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2026-06-15T19:10:21Z","modified":"2026-10-29T11:32:35Z","fixes":[{"ecosystem":"AlmaLinux:10","package":"gstreamer1-plugins-good","fixed_in":["1.26.7-2.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"gstreamer1-plugins-good-gtk","fixed_in":["1.26.7-2.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"gstreamer1-plugins-good","fixed_in":["1.16.1-7.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"gstreamer1-plugins-good-gtk","fixed_in":["1.16.1-7.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"gstreamer1-plugins-good","fixed_in":["1.22.12-7.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"gstreamer1-plugins-good-gtk","fixed_in":["1.22.12-7.el9_8.1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"gstreamer1-plugins-good","fixed_in":["1.22.12-4.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"gstreamer1-plugins-good-gtk","fixed_in":["1.22.12-4.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"gstreamer1-plugins-good-qt","fixed_in":["1.22.12-4.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gstreamer1-plugins-good","fixed_in":["1.18.4-6.el9.tuxcare.els18"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gstreamer1-plugins-good-gtk","fixed_in":["1.18.4-6.el9.tuxcare.els18"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gstreamer1-plugins-good-qt","fixed_in":["1.18.4-6.el9.tuxcare.els18"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"gstreamer1-plugins-good","fixed_in":["1.10.4-2.el7.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"gst-plugins-good1.0","fixed_in":["1.22.0-5+deb12u4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gst-plugins-good1.0","fixed_in":["1.28.4-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"gstreamer1-plugins-good","fixed_in":["0:1.26.7-2.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"gstreamer1-plugins-good-debuginfo","fixed_in":["0:1.26.7-2.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"gstreamer1-plugins-good-debugsource","fixed_in":["0:1.26.7-2.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"gstreamer1-plugins-good-gtk","fixed_in":["0:1.26.7-2.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"gstreamer1-plugins-good-gtk-debuginfo","fixed_in":["0:1.26.7-2.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"gstreamer1-plugins-good-qt6-debuginfo","fixed_in":["0:1.26.7-2.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-good","fixed_in":["0:1.16.1-7.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-good-debuginfo","fixed_in":["0:1.16.1-7.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-good-debugsource","fixed_in":["0:1.16.1-7.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-good-gtk","fixed_in":["0:1.16.1-7.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","fixed_in":["0:1.16.1-7.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-good","fixed_in":["0:1.22.12-7.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-good-debuginfo","fixed_in":["0:1.22.12-7.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-good-debugsource","fixed_in":["0:1.22.12-7.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-good-gtk","fixed_in":["0:1.22.12-7.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","fixed_in":["0:1.22.12-7.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-good-qt-debuginfo","fixed_in":["0:1.22.12-7.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gstreamer1-plugins-good","fixed_in":["0:1.24.11-1.el10_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gstreamer1-plugins-good-debuginfo","fixed_in":["0:1.24.11-1.el10_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gstreamer1-plugins-good-debugsource","fixed_in":["0:1.24.11-1.el10_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gstreamer1-plugins-good-gtk","fixed_in":["0:1.24.11-1.el10_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gstreamer1-plugins-good-gtk-debuginfo","fixed_in":["0:1.24.11-1.el10_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gstreamer1-plugins-good-qt6-debuginfo","fixed_in":["0:1.24.11-1.el10_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gstreamer1-plugins-good","fixed_in":["0:1.22.1-4.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gstreamer1-plugins-good-debuginfo","fixed_in":["0:1.22.1-4.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gstreamer1-plugins-good-debugsource","fixed_in":["0:1.22.1-4.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gstreamer1-plugins-good-gtk","fixed_in":["0:1.22.1-4.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","fixed_in":["0:1.22.1-4.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gstreamer1-plugins-good-qt-debuginfo","fixed_in":["0:1.22.1-4.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gstreamer1-plugins-good","fixed_in":["0:1.22.12-5.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gstreamer1-plugins-good-debuginfo","fixed_in":["0:1.22.12-5.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gstreamer1-plugins-good-debugsource","fixed_in":["0:1.22.12-5.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gstreamer1-plugins-good-gtk","fixed_in":["0:1.22.12-5.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","fixed_in":["0:1.22.12-5.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gstreamer1-plugins-good-qt-debuginfo","fixed_in":["0:1.22.12-5.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"gstreamer1-plugins-good","fixed_in":["0:1.18.4-8.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"gstreamer1-plugins-good-debuginfo","fixed_in":["0:1.18.4-8.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"gstreamer1-plugins-good-debugsource","fixed_in":["0:1.18.4-8.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"gstreamer1-plugins-good-gtk","fixed_in":["0:1.18.4-8.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","fixed_in":["0:1.18.4-8.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"gstreamer1-plugins-good-qt-debuginfo","fixed_in":["0:1.18.4-8.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"gstreamer1-plugins-good","fixed_in":["0:1.16.1-5.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"gstreamer1-plugins-good-debuginfo","fixed_in":["0:1.16.1-5.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"gstreamer1-plugins-good-debugsource","fixed_in":["0:1.16.1-5.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"gstreamer1-plugins-good-gtk","fixed_in":["0:1.16.1-5.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","fixed_in":["0:1.16.1-5.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"gstreamer1-plugins-good","fixed_in":["0:1.16.1-5.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"gstreamer1-plugins-good-debuginfo","fixed_in":["0:1.16.1-5.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"gstreamer1-plugins-good-debugsource","fixed_in":["0:1.16.1-5.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"gstreamer1-plugins-good-gtk","fixed_in":["0:1.16.1-5.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","fixed_in":["0:1.16.1-5.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"gstreamer1-plugins-good","fixed_in":["0:1.16.1-4.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"gstreamer1-plugins-good-debuginfo","fixed_in":["0:1.16.1-4.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"gstreamer1-plugins-good-debugsource","fixed_in":["0:1.16.1-4.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"gstreamer1-plugins-good-gtk","fixed_in":["0:1.16.1-4.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","fixed_in":["0:1.16.1-4.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"gstreamer1-plugins-good","fixed_in":["0:1.16.1-4.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"gstreamer1-plugins-good-debuginfo","fixed_in":["0:1.16.1-4.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"gstreamer1-plugins-good-debugsource","fixed_in":["0:1.16.1-4.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"gstreamer1-plugins-good-gtk","fixed_in":["0:1.16.1-4.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","fixed_in":["0:1.16.1-4.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"gstreamer1-plugins-good","fixed_in":["0:1.10.4-4.el7_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"gstreamer1-plugins-good-debuginfo","fixed_in":["0:1.10.4-4.el7_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"gstreamer1-plugins-good","fixed_in":["0:1.16.1-4.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"gstreamer1-plugins-good-debuginfo","fixed_in":["0:1.16.1-4.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"gstreamer1-plugins-good-debugsource","fixed_in":["0:1.16.1-4.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"gstreamer1-plugins-good-gtk","fixed_in":["0:1.16.1-4.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","fixed_in":["0:1.16.1-4.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"gstreamer1-plugins-good","fixed_in":["0:1.16.1-4.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"gstreamer1-plugins-good-debuginfo","fixed_in":["0:1.16.1-4.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"gstreamer1-plugins-good-debugsource","fixed_in":["0:1.16.1-4.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"gstreamer1-plugins-good-gtk","fixed_in":["0:1.16.1-4.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","fixed_in":["0:1.16.1-4.el8_6.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"gstreamer1-plugins-good","fixed_in":["0:1.26.7-2.el10_2.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"gstreamer1-plugins-good","fixed_in":["0:1.16.1-7.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"gstreamer1-plugins-good","fixed_in":["0:1.22.12-7.el9_8.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"gst-plugins-good1.0","fixed_in":["1.26.2-1+deb13u2.aikido.2","1.26.2-1+deb13u2.root.io.1","1.26.2-1+deb13u2.aikido.3"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-gst-plugins-good1.0","fixed_in":["1.26.2-1+deb13u2.aikido.2","1.26.2-1+deb13u2.root.io.1","1.26.2-1+deb13u2.aikido.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"gstreamer-plugins-good","fixed_in":["1.22.0-150500.4.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"gstreamer-plugins-good","fixed_in":["1.22.0-150500.4.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"gstreamer-plugins-good","fixed_in":["1.22.0-150500.4.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"gstreamer-plugins-good","fixed_in":["1.22.0-150500.4.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"gstreamer-plugins-good","fixed_in":["1.24.0-150600.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"gstreamer-plugins-good","fixed_in":["1.24.0-150600.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"gstreamer-plugins-good","fixed_in":["1.24.0-150600.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"gstreamer-plugins-good","fixed_in":["1.24.0-150600.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"gstreamer-plugins-good","fixed_in":["1.20.1-150400.3.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"gstreamer-plugins-good","fixed_in":["1.20.1-150400.3.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"gstreamer-plugins-good","fixed_in":["1.20.1-150400.3.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"gstreamer-plugins-good","fixed_in":["1.20.1-150400.3.17.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"gst-plugins-good1.0","fixed_in":["1.20.3-0ubuntu1.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"gst-plugins-good1.0","fixed_in":["1.24.2-1ubuntu1.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"gst-plugins-good1.0","fixed_in":["1.28.2-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"gstreamer-plugins-good","fixed_in":["1.26.7-160000.2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-2.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-2.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-7.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-7.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-7.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-7.el9_8.1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-4.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-4.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gstreamer1-plugins-good-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-4.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-6.el9.tuxcare.els18"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-6.el9.tuxcare.els18"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gstreamer1-plugins-good-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-6.el9.tuxcare.els18"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.el7.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.0.5.el7_9.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.0.5.el7.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-5+deb12u4"}]}],"versions":["1.22.0-5","1.22.0-5+deb12u1","1.22.0-5+deb12u2","1.22.0-5+deb12u3"]},{"source":"osv","ecosystem":"Debian:13","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.10-1","1.26.2-1","1.26.2-1+deb13u1","1.26.2-1+deb13u2","1.26.3-1","1.26.4-1","1.26.5-1","1.26.5-2","1.26.5-2+hurd.1","1.26.5-3","1.26.6-1","1.26.7-1","1.26.8-1","1.26.9-1","1.27.1-1","1.27.2-1","1.27.50-1","1.27.50-2","1.27.90-1","1.28.0-1","1.28.1-1","1.28.2-1","1.28.2-2","1.28.2-3","1.28.2-4","1.28.3-1","1.28.4-1","1.28.5-1","1.28.6-1","1.28.7-1","1.28.8-1","1.29.1-1","1.29.2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.4-1"}]}],"versions":["1.26.10-1","1.26.2-1","1.26.3-1","1.26.4-1","1.26.5-1","1.26.5-2","1.26.5-2+hurd.1","1.26.5-3","1.26.6-1","1.26.7-1","1.26.8-1","1.26.9-1","1.27.1-1","1.27.2-1","1.27.50-1","1.27.50-2","1.27.90-1","1.28.0-1","1.28.1-1","1.28.2-1","1.28.2-2","1.28.2-3","1.28.2-4","1.28.3-1"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-13.oe2203sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-9.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-9.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-9.oe2403sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-13.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.7-2.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.7-2.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.7-2.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.7-2.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.7-2.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"gstreamer1-plugins-good-qt6-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.7-2.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-7.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-7.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-7.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-7.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-7.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-7.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-7.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-7.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-7.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-7.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-good-qt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-7.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.11-1.el10_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.11-1.el10_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.11-1.el10_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.11-1.el10_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.11-1.el10_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gstreamer1-plugins-good-qt6-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.11-1.el10_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-4.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-4.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-4.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-4.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-4.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gstreamer1-plugins-good-qt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-4.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-5.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-5.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-5.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-5.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-5.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gstreamer1-plugins-good-qt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-5.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-8.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-8.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-8.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-8.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-8.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"gstreamer1-plugins-good-qt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-8.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.4-4.el7_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.4-4.el7_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_6.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.7-2.el10_2.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-7.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-7.el9_8.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-1+deb13u2.aikido.2"},{"fixed":"1.26.2-1+deb13u2.root.io.1"},{"fixed":"1.26.2-1+deb13u2.aikido.3"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-1+deb13u2.aikido.2"},{"fixed":"1.26.2-1+deb13u2.root.io.1"},{"fixed":"1.26.2-1+deb13u2.aikido.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-16.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-16.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.4.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.4.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.4.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-150500.4.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-150600.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150400.3.17.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.0-1ubuntu1","1.6.1-1ubuntu1","1.6.2-1ubuntu1","1.7.1-1ubuntu1","1.7.2-1ubuntu1","1.7.90-1ubuntu1","1.7.91-1ubuntu1","1.8.0-1ubuntu1","1.8.1-1ubuntu0.1","1.8.2-1ubuntu0.1","1.8.2-1ubuntu0.2","1.8.2-1ubuntu0.3","1.8.3-1ubuntu0.3","1.8.3-1ubuntu0.4","1.8.3-1ubuntu0.5","1.8.3-1ubuntu0.5+esm1","1.8.3-1ubuntu0.5+esm2","1.8.3-1ubuntu0.5+esm3","1.8.3-1ubuntu0.5+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.12.3-1ubuntu1","1.12.4-1ubuntu1","1.13.1-1ubuntu1","1.13.91-1ubuntu1","1.14.0-1ubuntu1","1.14.1-1ubuntu1~ubuntu18.04.1","1.14.4-1ubuntu1~ubuntu18.04.1","1.14.5-0ubuntu1~18.04.1","1.14.5-0ubuntu1~18.04.2","1.14.5-0ubuntu1~18.04.3","1.14.5-0ubuntu1~18.04.3+esm1","1.14.5-0ubuntu1~18.04.3+esm2","1.14.5-0ubuntu1~18.04.3+esm3","1.14.5-0ubuntu1~18.04.3+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.1-1ubuntu1","1.16.2-1ubuntu1","1.16.2-1ubuntu2","1.16.2-1ubuntu2.1","1.16.3-0ubuntu1","1.16.3-0ubuntu1.1","1.16.3-0ubuntu1.2","1.16.3-0ubuntu1.3","1.16.3-0ubuntu1.3+esm1","1.16.3-0ubuntu1.3+esm2","1.16.3-0ubuntu1.3+esm3","1.16.3-0ubuntu1.3+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-0ubuntu1.7"}]}],"versions":["1.18.5-1ubuntu2","1.18.5-1ubuntu3","1.20.0-2ubuntu1","1.20.1-1ubuntu1","1.20.3-0ubuntu1","1.20.3-0ubuntu1.1","1.20.3-0ubuntu1.3","1.20.3-0ubuntu1.4","1.20.3-0ubuntu1.5","1.20.3-0ubuntu1.6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-1ubuntu1.5"}]}],"versions":["1.22.6-1ubuntu1","1.22.6-1ubuntu2","1.22.8-3ubuntu1","1.22.9-1ubuntu1","1.24.0-1ubuntu5","1.24.0-1ubuntu7","1.24.1-2ubuntu1","1.24.2-1ubuntu1","1.24.2-1ubuntu1.1","1.24.2-1ubuntu1.2","1.24.2-1ubuntu1.3","1.24.2-1ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.0-1ubuntu2","1.26.0-1ubuntu3","1.26.2-1ubuntu1","1.26.4-1ubuntu1","1.26.5-1ubuntu1","1.26.5-1ubuntu2","1.26.5-1ubuntu2.1","1.26.5-1ubuntu2.2","1.26.5-1ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2-2ubuntu0.1"}]}],"versions":["1.26.5-1ubuntu2","1.27.2-1ubuntu1","1.27.90-1ubuntu1","1.28.0-1ubuntu1","1.28.0-1ubuntu3","1.28.1-1ubuntu1","1.28.2-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-0ubuntu1.7"}]}],"versions":["1.18.5-1ubuntu2","1.18.5-1ubuntu3","1.20.0-2ubuntu1","1.20.1-1ubuntu1","1.20.3-0ubuntu1","1.20.3-0ubuntu1.1","1.20.3-0ubuntu1.3","1.20.3-0ubuntu1.4","1.20.3-0ubuntu1.5","1.20.3-0ubuntu1.6"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-1ubuntu1.5"}]}],"versions":["1.22.6-1ubuntu1","1.22.6-1ubuntu2","1.22.8-3ubuntu1","1.22.9-1ubuntu1","1.24.0-1ubuntu5","1.24.0-1ubuntu7","1.24.1-2ubuntu1","1.24.2-1ubuntu1","1.24.2-1ubuntu1.1","1.24.2-1ubuntu1.2","1.24.2-1ubuntu1.3","1.24.2-1ubuntu1.4"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2-2ubuntu0.1"}]}],"versions":["1.26.5-1ubuntu2","1.27.2-1ubuntu1","1.27.90-1ubuntu1","1.28.0-1ubuntu1","1.28.0-1ubuntu3","1.28.1-1ubuntu1","1.28.2-2"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.2.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.0 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 7 extended lifecycle support"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 telecommunications update service"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.2 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.6 extended update support"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:36675","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36774","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37129","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47032","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47050","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47051","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47052","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47174","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:49602","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:49603","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:49604","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53705","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487615","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53705.json","tags":["x_sadp-csaf-vex"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53705","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rc6x-6x52-9whj"},{"url":"https://bugzilla.redhat.com/2487615","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-36675.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-36774.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-37129.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1783971636.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1784021188.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1788514547.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1790671701.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1792021687.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47540","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47606","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47613","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-53705","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3481","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17072","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73433","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73434","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3482","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3483","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3484","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3485","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36675.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53705","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36774.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_37129.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47032.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47050.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47051.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47052.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47174.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49602.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49603.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49604.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:36675","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:36774","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:37129","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262727-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1234421","tags":["report"]},{"url":"https://bugzilla.suse.com/1268449","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53705","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262842-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262843-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262844-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-53705","tags":["report"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2026-0035.html","tags":["report"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5069","tags":["report"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11797","tags":["report"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11811","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8584-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-39043","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-39044","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-53705","title":"Gstreamer1-plugins-good: gstreamer: heap buffer overflow in wavpack decoder via integer overflow","description":"A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file.","status":"published","published":"2026-06-15T19:10:21.93Z","modified":"2026-08-03T12:06:01.198Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-190","CWE-190"],"updated_at":"2026-11-02T14:19:59.761005Z"}],"euvd":[{"id":"EUVD-2026-36799","description":"A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file.","status":"published","published":"2026-06-15T19:10:21Z","modified":"2026-08-03T12:06:01Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T18:02:24.819631Z"}],"ghsa":[{"id":"GHSA-rc6x-6x52-9whj","title":"A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a...","description":"A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file.","status":"published","published":"2026-06-15T21:30:42Z","modified":"2026-08-03T12:33:38Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:10:02.233759Z"}],"nvd":[{"id":"CVE-2026-53705","description":"A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file.","status":"published","published":"2026-06-15T20:16:33.82Z","modified":"2026-08-03T13:18:50.903Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:12:23.846948Z"}],"osv":[{"id":"DEBIAN-CVE-2026-53705","description":"A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file.","status":"published","published":"2026-06-15T20:16:33.82Z","modified":"2026-10-15T18:00:11.874622106Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:57.236551Z"},{"id":"OESA-2026-3481","title":"gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related.  Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in GStreamer\u0026apos;s gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being copied, allowing a small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent heap memory.(CVE-2026-17072)\n\nA flaw was found in GStreamer\u0026apos;s WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file.(CVE-2026-53705)\n\nA flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets (98 and 10 bytes) without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 bytes, the counter underflows to a very large unsigned value, causing subsequent null-terminated string scanning to read far beyond the allocated heap buffer. Date-format normalization may also write beyond the buffer end. Confirmed impacts include heap out-of-bounds read, out-of-bounds write, heap information disclosure (adjacent data appearing in parsed metadata), and application crash/denial of service. The avidemux element is auto-plugged by playbin, decodebin, and gst-discoverer, so opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).(CVE-2026-73433)\n\nA flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp-\u0026gt;fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).(CVE-2026-73434)","status":"published","published":"2026-08-20T10:01:22Z","modified":"2026-08-20T10:15:05.010252257Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3482","title":"gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related.  Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in GStreamer\u0026apos;s gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being copied, allowing a small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent heap memory.(CVE-2026-17072)\n\nA flaw was found in GStreamer\u0026apos;s WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file.(CVE-2026-53705)","status":"published","published":"2026-08-20T10:01:27Z","modified":"2026-08-20T10:15:10.854988099Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3483","title":"gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related.  Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in GStreamer\u0026apos;s gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being copied, allowing a small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent heap memory.(CVE-2026-17072)\n\nA flaw was found in GStreamer\u0026apos;s WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file.(CVE-2026-53705)","status":"published","published":"2026-08-20T10:01:28Z","modified":"2026-08-20T10:15:04.959911677Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3484","title":"gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related.  Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in GStreamer\u0026apos;s gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being copied, allowing a small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent heap memory.(CVE-2026-17072)\n\nA flaw was found in GStreamer\u0026apos;s WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file.(CVE-2026-53705)\n\nA flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets (98 and 10 bytes) without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 bytes, the counter underflows to a very large unsigned value, causing subsequent null-terminated string scanning to read far beyond the allocated heap buffer. Date-format normalization may also write beyond the buffer end. Confirmed impacts include heap out-of-bounds read, out-of-bounds write, heap information disclosure (adjacent data appearing in parsed metadata), and application crash/denial of service. The avidemux element is auto-plugged by playbin, decodebin, and gst-discoverer, so opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).(CVE-2026-73433)\n\nA flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp-\u0026gt;fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).(CVE-2026-73434)","status":"published","published":"2026-08-20T10:01:38Z","modified":"2026-08-20T10:15:10.845685812Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3485","title":"gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related.  Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in GStreamer\u0026apos;s gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being copied, allowing a small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent heap memory.(CVE-2026-17072)\n\nA flaw was found in GStreamer\u0026apos;s WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file.(CVE-2026-53705)","status":"published","published":"2026-08-20T10:01:42Z","modified":"2026-08-20T10:15:14.22189121Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"RHSA-2026:36675","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2026-07-09T10:12:44Z","modified":"2026-08-04T10:22:59Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:36774","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2026-07-09T10:12:52Z","modified":"2026-08-04T10:23:03Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:37129","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2026-07-09T10:13:06Z","modified":"2026-08-04T10:23:11Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:47032","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2026-07-28T10:13:59Z","modified":"2026-08-04T10:25:33Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:47050","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2026-07-29T10:11:30Z","modified":"2026-08-04T10:25:33Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:47051","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2026-07-29T10:11:30Z","modified":"2026-08-04T10:25:34Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:47052","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2026-07-29T10:11:30Z","modified":"2026-08-04T10:25:35Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:47174","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2026-07-29T10:11:39Z","modified":"2026-08-04T10:25:47Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:49602","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2026-08-03T10:17:43Z","modified":"2026-08-04T10:26:50Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:49603","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2026-08-04T10:26:51Z","modified":"2026-08-04T10:31:04.450002492Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:49604","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2026-08-04T10:26:51Z","modified":"2026-08-04T10:33:08.070290089Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RLSA-2026:36675","title":"Important: gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.\n\nSecurity Fix(es):\n\n* gstreamer1-plugins-good: GStreamer: Heap buffer overflow in WavPack decoder via integer overflow (CVE-2026-53705)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-10T12:05:34.876921Z","modified":"2026-07-10T12:30:04.736794751Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:36774","title":"Important: gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.\n\nSecurity Fix(es):\n\n* gstreamer1-plugins-good: GStreamer: Heap buffer overflow in WavPack decoder via integer overflow (CVE-2026-53705)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-09T06:00:27.431682Z","modified":"2026-07-09T06:30:04.110023587Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:37129","title":"Important: gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.\n\nSecurity Fix(es):\n\n* gstreamer1-plugins-good: GStreamer: Heap buffer overflow in WavPack decoder via integer overflow (CVE-2026-53705)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-10T12:03:38.827258Z","modified":"2026-07-10T12:30:06.126250073Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2026-53705","description":"A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file.","status":"published","published":"2026-06-15T20:16:00Z","modified":"2026-10-02T00:30:05.032920126Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"ALSA-2026:36675","title":"Important: gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.  \n\nSecurity Fix(es):  \n\n  * gstreamer1-plugins-good: GStreamer: Heap buffer overflow in WavPack decoder via integer overflow (CVE-2026-53705)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-08T00:00:00Z","modified":"2026-10-29T11:30:29.724186826Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:36774","title":"Important: gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.  \n\nSecurity Fix(es):  \n\n  * gstreamer1-plugins-good: GStreamer: Heap buffer overflow in WavPack decoder via integer overflow (CVE-2026-53705)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-08T00:00:00Z","modified":"2026-10-29T11:02:26.432893725Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:37129","title":"Important: gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.  \n\nSecurity Fix(es):  \n\n  * gstreamer1-plugins-good: GStreamer: Heap buffer overflow in WavPack decoder via integer overflow (CVE-2026-53705)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-09T00:00:00Z","modified":"2026-10-29T11:32:35.426014576Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"CLSA-2026-1783971636","title":"gstreamer1-plugins-good: Fix of CVE-2026-53705","description":"- CVE-2026-53705: fix integer overflow in wavpack decoder output buffer\n  size calculation (rhbz#2487615)","status":"published","published":"2026-07-13T19:40:52Z","modified":"2026-10-26T09:31:15.775547479Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1784021188","title":"gstreamer1-plugins-good: Fix of CVE-2026-53705","description":"- CVE-2026-53705: fix integer overflow in WavPack decoder output buffer\n  size calculation that caused an undersized heap allocation","status":"published","published":"2026-07-14T09:26:42Z","modified":"2026-10-26T09:30:10.684023089Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1788514547","title":"gstreamer1-plugins-good: Fix of CVE-2026-53705","description":"- CVE-2026-53705: wavpackdec: fix integer overflows when validating the input\n  buffer size and when calculating the decode and output buffer sizes","status":"published","published":"2026-09-04T09:35:57Z","modified":"2026-10-26T09:31:56.211201933Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1790671701","title":"gstreamer1-plugins-good: Fix of 5 CVEs","description":"- rebase onto Oracle 1.10.4-2.0.5.el7_9\n- the vendor fixes in this build: CVE-2024-47540, CVE-2024-47606, CVE-2024-47613.\n  Oracle labels its qtdemux Theora patch CVE-2024-47607, but that CVE is the\n  gst_opus_dec_parse_header overflow in gst-plugins-base; the patch carries\n  upstream f8e398c4, which is CVE-2024-47606 and is what this package needs\n- drop 3 of the 4 TuxCare CVE backports, superseded by the vendor's own patches\n- CVE-2026-53705: keep the TuxCare fix as a follow-up patch. The vendor's\n  Patch1007 protects the dec_data allocation but leaves the output-buffer size\n  computed in 32-bit arithmetic on this branch, because upstream's fix relies\n  on a gsize refactor 1.10.4 does not have\n- restore the 18-byte WAVEFORMATEX offset that the vendor's Patch1003 dropped\n  while porting to the pre-2.67.4 glib API; without it every A_MS/ACM Matroska\n  track gets malformed codec_data\n- keep BuildRequires: gtk-doc unbounded rather than Oracle's \u003c= 1.25.1, which no\n  i686 buildroot can satisfy and which would split the generated documentation\n  between architectures\n- require gstreamer1-plugins-base \u003e= 1.10.4-2.0.3, the first of our builds in\n  which gst_video_info_set_format() returns the gboolean the vendor's Patch1004\n  tests","status":"published","published":"2026-09-29T08:48:29Z","modified":"2026-10-26T09:43:38.446466432Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1792021687","title":"gstreamer1-plugins-good: Fix of 4 CVEs","description":"- rebase onto Oracle 1.10.4-2.0.5.el7_9\n- the vendor fixes in this build: CVE-2024-47540, CVE-2024-47606, CVE-2024-47613.\n  Oracle labels its qtdemux Theora patch CVE-2024-47607, but that CVE is the\n  gst_opus_dec_parse_header overflow in gst-plugins-base; the patch carries\n  upstream f8e398c4, which is CVE-2024-47606 and is what this package needs\n- drop 3 of the 4 TuxCare CVE backports, superseded by the vendor's own patches\n- CVE-2026-53705: keep the TuxCare fix as a follow-up patch. The vendor's\n  Patch1007 protects the dec_data allocation but leaves the output-buffer size\n  computed in 32-bit arithmetic on this branch, because upstream's fix relies\n  on a gsize refactor 1.10.4 does not have\n- restore the 18-byte WAVEFORMATEX offset that the vendor's Patch1003 dropped\n  while porting to the pre-2.67.4 glib API; without it every A_MS/ACM Matroska\n  track gets malformed codec_data\n- keep BuildRequires: gtk-doc unbounded rather than Oracle's \u003c= 1.25.1, which no\n  i686 buildroot can satisfy and which would split the generated documentation\n  between architectures\n- require gstreamer1-plugins-base \u003e= 1.10.4-2.0.3, the first of our builds in\n  which gst_video_info_set_format() returns the gboolean the vendor's Patch1004\n  tests","status":"published","published":"2026-10-17T13:05:05Z","modified":"2026-10-26T09:43:54.479409394Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"openSUSE-SU-2026:21240-1","title":"Security update for gstreamer-plugins-good","description":"This update for gstreamer-plugins-good fixes the following issues:\n\n- CVE-2026-53705: wavpackdec: Avoid integer overflow when calculating output buffer size and related fixes (bsc#1268449).\n","status":"published","published":"2026-07-06T08:52:57Z","modified":"2026-07-09T18:24:13.953699206Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-53705","title":"CVE-2026-53705 in gst-plugins-good1.0 - Patched by Root","description":"Root has patched CVE-2026-53705 in the gst-plugins-good1.0 package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-31T10:46:11Z","modified":"2026-10-16T13:00:08.41854389Z","updated_at":"2026-11-02T15:53:32.298225Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-53705","title":"CVE-2026-53705 in gst-plugins-good1.0 - Patched by Root","description":"Root has patched CVE-2026-53705 in the gst-plugins-good1.0 package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-09-07T10:37:10Z","modified":"2026-09-07T11:30:05.235489723Z","updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"SUSE-SU-2026:2727-1","title":"Security update for gstreamer-plugins-good","description":"This update for gstreamer-plugins-good fixes the following issues\n\n- CVE-2024-47540: uninitialized stack memory in Matroska/WebM demuxer (bsc#1234421).\n- CVE-2026-53705: Heap buffer overflow in WavPack decoder via integer overflow (bsc#1268449).\n","status":"published","published":"2026-07-02T14:04:37Z","modified":"2026-07-03T11:00:05.518282157Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:2842-1","title":"Security update for gstreamer-plugins-good","description":"This update for gstreamer-plugins-good fixes the following issue\n\n- CVE-2026-53705: Heap buffer overflow in WavPack decoder via integer overflow (bsc#1268449).\n","status":"published","published":"2026-07-10T10:24:59Z","modified":"2026-07-11T09:15:04.728221096Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:2843-1","title":"Security update for gstreamer-plugins-good","description":"This update for gstreamer-plugins-good fixes the following issue\n\n- CVE-2026-53705: Heap buffer overflow in WavPack decoder via integer overflow (bsc#1268449).\n","status":"published","published":"2026-07-10T10:28:21Z","modified":"2026-07-11T09:15:05.147682865Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:2844-1","title":"Security update for gstreamer-plugins-good","description":"This update for gstreamer-plugins-good fixes the following issue\n\n- CVE-2026-53705: Heap buffer overflow in WavPack decoder via integer overflow (bsc#1268449).\n","status":"published","published":"2026-07-10T10:29:13Z","modified":"2026-07-11T09:15:05.150058554Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"USN-8584-1","title":"gst-plugins-good1.0 vulnerabilities","description":"It was discovered that GStreamer Good Plugins incorrectly handled certain\nMatroska files. An attacker could possibly use this issue to cause\nGStreamer Good Plugins to crash, resulting in a denial of service. This\nissue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-39043)\n\nIt was discovered that GStreamer Good Plugins incorrectly handled certain\nWAV files. An attacker could possibly use this issue to cause GStreamer\nGood Plugins to crash, resulting in a denial of service. This issue only\naffected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-39044)\n\nIt was discovered that GStreamer Good Plugins incorrectly handled certain\nWavPack audio files. An attacker could use this issue to cause GStreamer\nGood Plugins to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2026-53705)","status":"published","published":"2026-07-22T12:52:28Z","modified":"2026-07-22T20:59:39.963357531Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}