{"id":"CVE-2026-73434","aliases":["ALSA-2026:55434","ALSA-2026:55436","ALSA-2026:56966","CLSA-2026-1787660556","CLSA-2026-1788272453","CLSA-2026-1792238729","CLSA-2026-1792239628","CLSA-2026-1792255236","CLSA-2026-1792532772","CLSA-2026-1792532987","CLSA-2026-1792533291","DEBIAN-CVE-2026-73434","EUVD-2026-57443","GHSA-wfhj-v65x-vjp5","OESA-2026-3481","OESA-2026-3484","OESA-2026-3649","OESA-2026-3650","RHSA-2026:55434","RHSA-2026:55436","RHSA-2026:56966","RHSA-2026:65959","RHSA-2026:68642","RHSA-2026:68644","RHSA-2026:68645","RHSA-2026:69232","RHSA-2026:70264","RHSA-2026:70584","RHSA-2026:70803","RLSA-2026:55434","RLSA-2026:55436","RLSA-2026:56966","UBUNTU-CVE-2026-73434","USN-8863-1"],"status":"published","title":"Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing","description":"A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp-\u003efields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00148,"percentile":0.04083,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-08-12T19:05:23Z","modified":"2026-11-04T02:47:50Z","fixes":[{"ecosystem":"Debian:12","package":"gst-plugins-good1.0","fixed_in":["1.22.0-5+deb12u4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gst-plugins-good1.0","fixed_in":["1.28.6-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gst-plugins-good1.0","fixed_in":["1.8.3-1ubuntu0.5+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gst-plugins-good1.0","fixed_in":["1.14.5-0ubuntu1~18.04.3+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gst-plugins-good1.0","fixed_in":["1.16.3-0ubuntu1.3+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"gst-plugins-good1.0","fixed_in":["1.20.3-0ubuntu1.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"gst-plugins-good1.0","fixed_in":["1.24.2-1ubuntu1.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"gst-plugins-good1.0","fixed_in":["1.28.2-2ubuntu0.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-2.el10_2.5"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-2.el10_2.5"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-7.el9_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-7.el9_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-7.el8_10.3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-7.el8_10.3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-4.el9.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-4.el9.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gstreamer1-plugins-good-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-4.el9.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-6.el9.tuxcare.els20"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-6.el9.tuxcare.els20"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gstreamer1-plugins-good-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-6.el9.tuxcare.els20"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.0.5.el7_9.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.0.5.el7.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.0.5.el7.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.0.7.el7.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.0.7.el7_9.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-2.0.7.el7.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"Debian:12","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-5+deb12u4"}]}],"versions":["1.22.0-5","1.22.0-5+deb12u1","1.22.0-5+deb12u2","1.22.0-5+deb12u3"]},{"source":"osv","ecosystem":"Debian:13","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.10-1","1.26.2-1","1.26.2-1+deb13u1","1.26.2-1+deb13u2","1.26.3-1","1.26.4-1","1.26.5-1","1.26.5-2","1.26.5-2+hurd.1","1.26.5-3","1.26.6-1","1.26.7-1","1.26.8-1","1.26.9-1","1.27.1-1","1.27.2-1","1.27.50-1","1.27.50-2","1.27.90-1","1.28.0-1","1.28.1-1","1.28.2-1","1.28.2-2","1.28.2-3","1.28.2-4","1.28.3-1","1.28.4-1","1.28.5-1","1.28.6-1","1.28.7-1","1.28.8-1","1.29.1-1","1.29.2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.6-1"}]}],"versions":["1.26.10-1","1.26.2-1","1.26.3-1","1.26.4-1","1.26.5-1","1.26.5-2","1.26.5-2+hurd.1","1.26.5-3","1.26.6-1","1.26.7-1","1.26.8-1","1.26.9-1","1.27.1-1","1.27.2-1","1.27.50-1","1.27.50-2","1.27.90-1","1.28.0-1","1.28.1-1","1.28.2-1","1.28.2-2","1.28.2-3","1.28.2-4","1.28.3-1","1.28.4-1","1.28.5-1"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-13.oe2203sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-9.oe2403sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-9.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-9.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.7-2.el10_2.5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.7-2.el10_2.5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.7-2.el10_2.5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.7-2.el10_2.5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.7-2.el10_2.5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"gstreamer1-plugins-good-qt6-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.7-2.el10_2.5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-7.el9_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-7.el9_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-7.el9_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-7.el9_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-7.el9_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gstreamer1-plugins-good-qt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-7.el9_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-7.el8_10.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-7.el8_10.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-7.el8_10.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-7.el8_10.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-7.el8_10.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.11-1.el10_0.4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.11-1.el10_0.4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.11-1.el10_0.4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.11-1.el10_0.4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.11-1.el10_0.4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gstreamer1-plugins-good-qt6-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.24.11-1.el10_0.4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-4.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-4.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-4.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-4.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-4.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"gstreamer1-plugins-good-qt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-4.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-5.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-5.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-5.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-5.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-5.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"gstreamer1-plugins-good-qt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-5.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-8.el9_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-8.el9_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-8.el9_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-8.el9_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-8.el9_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"gstreamer1-plugins-good-qt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.4-8.el9_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_8.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_8.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_8.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_8.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_8.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_8.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_8.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_8.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_8.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.el8_8.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.4-4.el7_9.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.4-4.el7_9.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_6.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_6.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_6.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_6.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_6.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_6.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_6.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_6.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_6.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_6.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_4.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_4.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_4.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_4.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_4.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_4.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"gstreamer1-plugins-good-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_4.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"gstreamer1-plugins-good-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_4.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_4.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"gstreamer1-plugins-good-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.el8_4.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:10","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.7-2.el10_2.5"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.12-7.el9_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-7.el8_10.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1ubuntu0.5+esm4"}]}],"versions":["1.6.0-1ubuntu1","1.6.1-1ubuntu1","1.6.2-1ubuntu1","1.7.1-1ubuntu1","1.7.2-1ubuntu1","1.7.90-1ubuntu1","1.7.91-1ubuntu1","1.8.0-1ubuntu1","1.8.1-1ubuntu0.1","1.8.2-1ubuntu0.1","1.8.2-1ubuntu0.2","1.8.2-1ubuntu0.3","1.8.3-1ubuntu0.3","1.8.3-1ubuntu0.4","1.8.3-1ubuntu0.5","1.8.3-1ubuntu0.5+esm1","1.8.3-1ubuntu0.5+esm2","1.8.3-1ubuntu0.5+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.5-0ubuntu1~18.04.3+esm4"}]}],"versions":["1.12.3-1ubuntu1","1.12.4-1ubuntu1","1.13.1-1ubuntu1","1.13.91-1ubuntu1","1.14.0-1ubuntu1","1.14.1-1ubuntu1~ubuntu18.04.1","1.14.4-1ubuntu1~ubuntu18.04.1","1.14.5-0ubuntu1~18.04.1","1.14.5-0ubuntu1~18.04.2","1.14.5-0ubuntu1~18.04.3","1.14.5-0ubuntu1~18.04.3+esm1","1.14.5-0ubuntu1~18.04.3+esm2","1.14.5-0ubuntu1~18.04.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-0ubuntu1.3+esm4"}]}],"versions":["1.16.1-1ubuntu1","1.16.2-1ubuntu1","1.16.2-1ubuntu2","1.16.2-1ubuntu2.1","1.16.3-0ubuntu1","1.16.3-0ubuntu1.1","1.16.3-0ubuntu1.2","1.16.3-0ubuntu1.3","1.16.3-0ubuntu1.3+esm1","1.16.3-0ubuntu1.3+esm2","1.16.3-0ubuntu1.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-0ubuntu1.10"}]}],"versions":["1.18.5-1ubuntu2","1.18.5-1ubuntu3","1.20.0-2ubuntu1","1.20.1-1ubuntu1","1.20.3-0ubuntu1","1.20.3-0ubuntu1.1","1.20.3-0ubuntu1.3","1.20.3-0ubuntu1.4","1.20.3-0ubuntu1.5","1.20.3-0ubuntu1.6","1.20.3-0ubuntu1.7","1.20.3-0ubuntu1.8","1.20.3-0ubuntu1.9"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-1ubuntu1.8"}]}],"versions":["1.22.6-1ubuntu1","1.22.6-1ubuntu2","1.22.8-3ubuntu1","1.22.9-1ubuntu1","1.24.0-1ubuntu5","1.24.0-1ubuntu7","1.24.1-2ubuntu1","1.24.2-1ubuntu1","1.24.2-1ubuntu1.1","1.24.2-1ubuntu1.2","1.24.2-1ubuntu1.3","1.24.2-1ubuntu1.4","1.24.2-1ubuntu1.5","1.24.2-1ubuntu1.6","1.24.2-1ubuntu1.7"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2-2ubuntu0.4"}]}],"versions":["1.26.5-1ubuntu2","1.27.2-1ubuntu1","1.27.90-1ubuntu1","1.28.0-1ubuntu1","1.28.0-1ubuntu3","1.28.1-1ubuntu1","1.28.2-2","1.28.2-2ubuntu0.1","1.28.2-2ubuntu0.2","1.28.2-2ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1ubuntu0.5+esm4"}]}],"versions":["1.6.0-1ubuntu1","1.6.1-1ubuntu1","1.6.2-1ubuntu1","1.7.1-1ubuntu1","1.7.2-1ubuntu1","1.7.90-1ubuntu1","1.7.91-1ubuntu1","1.8.0-1ubuntu1","1.8.1-1ubuntu0.1","1.8.2-1ubuntu0.1","1.8.2-1ubuntu0.2","1.8.2-1ubuntu0.3","1.8.3-1ubuntu0.3","1.8.3-1ubuntu0.4","1.8.3-1ubuntu0.5","1.8.3-1ubuntu0.5+esm1","1.8.3-1ubuntu0.5+esm2","1.8.3-1ubuntu0.5+esm3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.5-0ubuntu1~18.04.3+esm4"}]}],"versions":["1.12.3-1ubuntu1","1.12.4-1ubuntu1","1.13.1-1ubuntu1","1.13.91-1ubuntu1","1.14.0-1ubuntu1","1.14.1-1ubuntu1~ubuntu18.04.1","1.14.4-1ubuntu1~ubuntu18.04.1","1.14.5-0ubuntu1~18.04.1","1.14.5-0ubuntu1~18.04.2","1.14.5-0ubuntu1~18.04.3","1.14.5-0ubuntu1~18.04.3+esm1","1.14.5-0ubuntu1~18.04.3+esm2","1.14.5-0ubuntu1~18.04.3+esm3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-0ubuntu1.3+esm4"}]}],"versions":["1.16.1-1ubuntu1","1.16.2-1ubuntu1","1.16.2-1ubuntu2","1.16.2-1ubuntu2.1","1.16.3-0ubuntu1","1.16.3-0ubuntu1.1","1.16.3-0ubuntu1.2","1.16.3-0ubuntu1.3","1.16.3-0ubuntu1.3+esm1","1.16.3-0ubuntu1.3+esm2","1.16.3-0ubuntu1.3+esm3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-0ubuntu1.10"}]}],"versions":["1.18.5-1ubuntu2","1.18.5-1ubuntu3","1.20.0-2ubuntu1","1.20.1-1ubuntu1","1.20.3-0ubuntu1","1.20.3-0ubuntu1.1","1.20.3-0ubuntu1.3","1.20.3-0ubuntu1.4","1.20.3-0ubuntu1.5","1.20.3-0ubuntu1.6","1.20.3-0ubuntu1.7","1.20.3-0ubuntu1.8","1.20.3-0ubuntu1.9"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-1ubuntu1.8"}]}],"versions":["1.22.6-1ubuntu1","1.22.6-1ubuntu2","1.22.8-3ubuntu1","1.22.9-1ubuntu1","1.24.0-1ubuntu5","1.24.0-1ubuntu7","1.24.1-2ubuntu1","1.24.2-1ubuntu1","1.24.2-1ubuntu1.1","1.24.2-1ubuntu1.2","1.24.2-1ubuntu1.3","1.24.2-1ubuntu1.4","1.24.2-1ubuntu1.5","1.24.2-1ubuntu1.6","1.24.2-1ubuntu1.7"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2-2ubuntu0.4"}]}],"versions":["1.26.5-1ubuntu2","1.27.2-1ubuntu1","1.27.90-1ubuntu1","1.28.0-1ubuntu1","1.28.0-1ubuntu3","1.28.1-1ubuntu1","1.28.2-2","1.28.2-2ubuntu0.1","1.28.2-2ubuntu0.2","1.28.2-2ubuntu0.3"],"bundled":4}],"products":[{"vendor":"gstreamer","product":"gst-plugins-good"},{"vendor":"gstreamer","product":"gstreamer"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.0 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 7 extended lifecycle support"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 telecommunications update service"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.2 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.6 extended update support"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:55434","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55436","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:56966","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:65959","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68642","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68644","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68645","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69232","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:70264","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:70584","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:70803","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73434","tags":["vdb-entry","x_refsource_REDHAT","Third Party Advisory","report","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514807","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Third Party Advisory","report"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231","tags":["Issue Tracking","fix","article","report"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2026-0072.html","tags":["Patch","Vendor Advisory","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73434","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wfhj-v65x-vjp5"},{"url":"https://access.redhat.com/security/cve/CVE-2026-73433","tags":["report"]},{"url":"https://bugzilla.redhat.com/2514801","tags":["report"]},{"url":"https://bugzilla.redhat.com/2514807","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-55434.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-55436.html","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18649","tags":["report"]},{"url":"https://bugzilla.redhat.com/2510614","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-56966.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1787660556.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73433","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1788272453.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18295","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18296","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18298","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18299","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1792238729.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47540","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47613","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1792239628.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1792255236.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1792532772.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1792532987.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1792533291.html","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73434.json","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gst-plugins-good","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-73434","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3481","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17072","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53705","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3484","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3649","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3650","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514801","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55434.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73433","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73434","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55436.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510614","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_56966.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18649","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18649","tags":["advisory"]},{"url":"https://0xsemizzz.vercel.app/projects/cve-2026-18649-gstreamer-rtp-dos/","tags":["article"]},{"url":"https://github.com/0xSemizzz/CVE-2026-18649","tags":["article"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/113","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65959.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68642.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68644.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68645.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69232.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70264.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70584.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70803.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:55434","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:55436","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:56966","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-73434","tags":["report"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12241","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8863-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-17072","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-73433","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-88914","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-73434","title":"Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing","description":"A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp-\u003efields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).","status":"published","published":"2026-08-12T19:05:23.429Z","modified":"2026-09-23T15:06:16.003Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T13:43:33.766176Z"}],"euvd":[{"id":"EUVD-2026-57443","description":"A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp-\u003efields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).","status":"published","published":"2026-08-12T19:05:23Z","modified":"2026-09-23T15:06:16Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T17:28:00.617613Z"}],"ghsa":[{"id":"GHSA-wfhj-v65x-vjp5","title":"A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(),...","description":"A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp-\u003efields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).","status":"published","published":"2026-08-12T21:31:43Z","modified":"2026-09-23T15:31:45Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:12:20.494129Z"}],"nvd":[{"id":"CVE-2026-73434","description":"A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp-\u003efields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).","status":"published","published":"2026-08-12T20:17:56.943Z","modified":"2026-09-23T15:17:17.287Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:12:37.217486Z"}],"osv":[{"id":"CVE-2026-73434","title":"Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing","description":"A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp-\u003efields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).","status":"published","published":"2026-08-12T19:05:23.429Z","modified":"2026-11-04T02:47:50.949028464Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-04T02:53:00.786919Z"},{"id":"DEBIAN-CVE-2026-73434","description":"A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp-\u003efields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).","status":"published","published":"2026-08-12T20:17:56.943Z","modified":"2026-10-15T18:00:09.937222686Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:46:02.499355Z"},{"id":"OESA-2026-3481","title":"gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related.  Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in GStreamer\u0026apos;s gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being copied, allowing a small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent heap memory.(CVE-2026-17072)\n\nA flaw was found in GStreamer\u0026apos;s WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file.(CVE-2026-53705)\n\nA flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets (98 and 10 bytes) without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 bytes, the counter underflows to a very large unsigned value, causing subsequent null-terminated string scanning to read far beyond the allocated heap buffer. Date-format normalization may also write beyond the buffer end. Confirmed impacts include heap out-of-bounds read, out-of-bounds write, heap information disclosure (adjacent data appearing in parsed metadata), and application crash/denial of service. The avidemux element is auto-plugged by playbin, decodebin, and gst-discoverer, so opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).(CVE-2026-73433)\n\nA flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp-\u0026gt;fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).(CVE-2026-73434)","status":"published","published":"2026-08-20T10:01:22Z","modified":"2026-08-20T10:15:05.010252257Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3484","title":"gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related.  Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in GStreamer\u0026apos;s gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being copied, allowing a small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent heap memory.(CVE-2026-17072)\n\nA flaw was found in GStreamer\u0026apos;s WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file.(CVE-2026-53705)\n\nA flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets (98 and 10 bytes) without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 bytes, the counter underflows to a very large unsigned value, causing subsequent null-terminated string scanning to read far beyond the allocated heap buffer. Date-format normalization may also write beyond the buffer end. Confirmed impacts include heap out-of-bounds read, out-of-bounds write, heap information disclosure (adjacent data appearing in parsed metadata), and application crash/denial of service. The avidemux element is auto-plugged by playbin, decodebin, and gst-discoverer, so opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).(CVE-2026-73433)\n\nA flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp-\u0026gt;fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).(CVE-2026-73434)","status":"published","published":"2026-08-20T10:01:38Z","modified":"2026-08-20T10:15:10.845685812Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3649","title":"gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related.  Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets (98 and 10 bytes) without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 bytes, the counter underflows to a very large unsigned value, causing subsequent null-terminated string scanning to read far beyond the allocated heap buffer. Date-format normalization may also write beyond the buffer end. Confirmed impacts include heap out-of-bounds read, out-of-bounds write, heap information disclosure (adjacent data appearing in parsed metadata), and application crash/denial of service. The avidemux element is auto-plugged by playbin, decodebin, and gst-discoverer, so opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).(CVE-2026-73433)\n\nA flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp-\u0026gt;fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).(CVE-2026-73434)","status":"published","published":"2026-09-05T15:03:30Z","modified":"2026-09-05T15:16:33.731642923Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3650","title":"gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related.  Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets (98 and 10 bytes) without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 bytes, the counter underflows to a very large unsigned value, causing subsequent null-terminated string scanning to read far beyond the allocated heap buffer. Date-format normalization may also write beyond the buffer end. Confirmed impacts include heap out-of-bounds read, out-of-bounds write, heap information disclosure (adjacent data appearing in parsed metadata), and application crash/denial of service. The avidemux element is auto-plugged by playbin, decodebin, and gst-discoverer, so opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).(CVE-2026-73433)\n\nA flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp-\u0026gt;fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).(CVE-2026-73434)","status":"published","published":"2026-09-05T15:03:30Z","modified":"2026-09-05T15:16:33.721557738Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"RHSA-2026:55434","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2026-08-17T10:16:55Z","modified":"2026-09-24T10:11:00Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:55436","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2026-08-17T10:16:56Z","modified":"2026-09-24T10:11:01Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:56966","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2026-08-20T10:19:59Z","modified":"2026-10-08T10:15:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:65959","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2026-09-10T10:17:05Z","modified":"2026-10-08T10:17:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68642","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2026-09-19T10:14:08Z","modified":"2026-09-24T10:14:12Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68644","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2026-09-18T10:15:26Z","modified":"2026-09-24T10:14:13Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68645","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2026-09-18T10:15:27Z","modified":"2026-09-24T10:14:14Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:69232","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2026-09-21T10:14:58Z","modified":"2026-10-08T10:18:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:70264","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2026-09-23T10:15:21Z","modified":"2026-10-08T10:18:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:70584","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2026-09-23T10:15:26Z","modified":"2026-10-08T10:18:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:70803","title":"Red Hat Security Advisory: gstreamer1-plugins-good security update","status":"published","published":"2026-09-24T10:15:09Z","modified":"2026-10-08T10:18:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RLSA-2026:55434","title":"Moderate: gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.\n\nSecurity Fix(es):\n\n* gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write (CVE-2026-73433)\n\n* gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing (CVE-2026-73434)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-17T18:06:54.076078Z","modified":"2026-08-17T18:30:04.813754952Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:55436","title":"Moderate: gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.\n\nSecurity Fix(es):\n\n* gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write (CVE-2026-73433)\n\n* gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing (CVE-2026-73434)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-17T18:03:57.407277Z","modified":"2026-08-17T18:30:03.408691281Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:56966","title":"Moderate: gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.\n\nSecurity Fix(es):\n\n* gst-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders (CVE-2026-18649)\n\n* gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write (CVE-2026-73433)\n\n* gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing (CVE-2026-73434)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-20T06:01:13.357231Z","modified":"2026-08-20T06:30:03.64075954Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2026-73434","description":"A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp-\u003efields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).","status":"published","published":"2026-08-12T20:17:00Z","modified":"2026-10-02T00:30:03.827448799Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:57:08.628462Z"},{"id":"ALSA-2026:55434","title":"Moderate: gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.  \n\nSecurity Fix(es):  \n\n  * gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write (CVE-2026-73433)\n  * gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing (CVE-2026-73434)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-17T00:00:00Z","modified":"2026-10-29T11:30:38.657871072Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:55436","title":"Moderate: gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.  \n\nSecurity Fix(es):  \n\n  * gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write (CVE-2026-73433)\n  * gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing (CVE-2026-73434)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-17T00:00:00Z","modified":"2026-10-29T11:32:24.950356482Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:56966","title":"Moderate: gstreamer1-plugins-good security update","description":"GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.  \n\nSecurity Fix(es):  \n\n  * gst-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders (CVE-2026-18649)\n  * gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write (CVE-2026-73433)\n  * gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing (CVE-2026-73434)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-19T00:00:00Z","modified":"2026-10-29T11:02:24.905794311Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"CLSA-2026-1787660556","title":"gstreamer1-plugins-good: Fix of 2 CVEs","description":"- CVE-2026-73433: avidemux: make sure enough data is available when parsing\n  FUJIFILM strd and stop modifying read-only mapped buffer data\n- CVE-2026-73434: avidemux: use the correct divisor when calculating the\n  available number of vprp field infos","status":"published","published":"2026-08-25T15:19:28Z","modified":"2026-10-26T09:31:29.654334688Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1788272453","title":"gstreamer1-plugins-good: Fix of 6 CVEs","description":"- CVE-2026-18295: fix out-of-bounds write in MRF atoms recovery parsing that\n  could lead to remote code execution\n- CVE-2026-18296: fix heap-based buffer overflow in MRF atoms recovery\n  parsing that could lead to remote code execution\n- CVE-2026-18298: drop gdkpixbufdec rank to NONE and fix output buffer pool\n  not being reconfigured on format/resolution changes between frames\n- CVE-2026-18299: fix use-after-free in rtpsbcdepay RTP payload processing\n- CVE-2026-73433: fix integer underflow in avidemux FUJIFILM strd metadata\n  parsing that could cause an out-of-bounds read/write\n- CVE-2026-73434: fix out-of-bounds read in avidemux vprp video field\n  descriptor parsing caused by an incorrect divisor","status":"published","published":"2026-09-01T14:21:08Z","modified":"2026-10-26T09:30:33.192637039Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1792238729","title":"gstreamer1-plugins-good: Fix of 4 CVEs","description":"- CVE-2026-73433: avidemux: fix unsigned integer underflow and out-of-bounds\n  access when parsing FUJIFILM metadata in strd chunks\n- CVE-2026-73434: avidemux: fix out-of-bounds read by using the correct divisor\n  when counting vprp video field descriptors","status":"published","published":"2026-10-21T12:03:26Z","modified":"2026-10-26T09:31:46.503916753Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792239628","title":"gstreamer1-plugins-good: Fix of 2 CVEs","description":"- CVE-2026-73433: avidemux: fix unsigned integer underflow and out-of-bounds\n  access when parsing FUJIFILM metadata in strd chunks\n- CVE-2026-73434: avidemux: fix out-of-bounds read by using the correct divisor\n  when counting vprp video field descriptors","status":"published","published":"2026-10-23T12:35:17Z","modified":"2026-10-26T09:31:43.212657978Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792255236","title":"gstreamer1-plugins-good: Fix of 2 CVEs","description":"- CVE-2026-73433: avidemux: fix unsigned integer underflow and out-of-bounds\n  access when parsing FUJIFILM metadata in strd chunks\n- CVE-2026-73434: avidemux: fix out-of-bounds read by using the correct divisor\n  when counting vprp video field descriptors","status":"published","published":"2026-10-17T17:32:56Z","modified":"2026-10-26T09:31:59.327769649Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792532772","title":"gstreamer1-plugins-good: Fix of 4 CVEs","description":"- rebase onto Oracle 1.10.4-2.0.7.el7_9\n- the vendor fixes in this build: CVE-2026-18295 and CVE-2026-18296\n  (qtmoovrecover: validate box sizes), CVE-2026-18298 (gdkpixbufdec: handle\n  format and resolution changes correctly) and CVE-2026-18299 (rtpsbcdepay:\n  check that enough data is available in the adapter)\n- keep the TuxCare wavpackdec follow-up to the vendor's Patch1007: it widens the\n  output-buffer size computation in gst_wavpack_dec_handle_frame() to gsize,\n  which the vendor's backport leaves in 32-bit arithmetic on this branch\n- keep the matroska-demux.c correction that restores the 18-byte WAVEFORMATEX\n  offset dropped by the vendor's Patch1003 in its pre-2.67.4 glib port\n- keep the gtk-doc build fix and BuildRequires: gtk-doc unbounded rather than\n  Oracle's \u003c= 1.25.1, which no i686 buildroot can satisfy\n- renumber the two TuxCare follow-up patches to Patch1011 and Patch1012; Oracle\n  took 1008 and 1009 for its own patches in this build\n- keep the CVE-2026-73433 and CVE-2026-73434 avidemux fixes from\n  1.10.4-2.0.5.tuxcare.els2, renumbered to Patch1013 and Patch1014 since\n  Oracle took 1010 in this build","status":"published","published":"2026-10-21T08:18:47Z","modified":"2026-10-26T09:31:59.326608504Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792532987","title":"gstreamer1-plugins-good: Fix of 4 CVEs","description":"- rebase onto Oracle 1.10.4-2.0.7.el7_9\n- the vendor fixes in this build: CVE-2026-18295 and CVE-2026-18296\n  (qtmoovrecover: validate box sizes), CVE-2026-18298 (gdkpixbufdec: handle\n  format and resolution changes correctly) and CVE-2026-18299 (rtpsbcdepay:\n  check that enough data is available in the adapter)\n- keep the TuxCare wavpackdec follow-up to the vendor's Patch1007: it widens the\n  output-buffer size computation in gst_wavpack_dec_handle_frame() to gsize,\n  which the vendor's backport leaves in 32-bit arithmetic on this branch\n- keep the matroska-demux.c correction that restores the 18-byte WAVEFORMATEX\n  offset dropped by the vendor's Patch1003 in its pre-2.67.4 glib port\n- keep the gtk-doc build fix and BuildRequires: gtk-doc unbounded rather than\n  Oracle's \u003c= 1.25.1, which no i686 buildroot can satisfy\n- renumber the two TuxCare follow-up patches to Patch1011 and Patch1012; Oracle\n  took 1008 and 1009 for its own patches in this build\n- keep the CVE-2026-73433 and CVE-2026-73434 avidemux fixes from\n  1.10.4-2.0.5.tuxcare.els2, renumbered to Patch1013 and Patch1014 since\n  Oracle took 1010 in this build","status":"published","published":"2026-10-21T08:15:45Z","modified":"2026-10-26T09:31:57.127460554Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792533291","title":"gstreamer1-plugins-good: Fix of 4 CVEs","description":"- rebase onto Oracle 1.10.4-2.0.7.el7_9\n- the vendor fixes in this build: CVE-2026-18295 and CVE-2026-18296\n  (qtmoovrecover: validate box sizes), CVE-2026-18298 (gdkpixbufdec: handle\n  format and resolution changes correctly) and CVE-2026-18299 (rtpsbcdepay:\n  check that enough data is available in the adapter)\n- keep the TuxCare wavpackdec follow-up to the vendor's Patch1007: it widens the\n  output-buffer size computation in gst_wavpack_dec_handle_frame() to gsize,\n  which the vendor's backport leaves in 32-bit arithmetic on this branch\n- keep the matroska-demux.c correction that restores the 18-byte WAVEFORMATEX\n  offset dropped by the vendor's Patch1003 in its pre-2.67.4 glib port\n- keep the gtk-doc build fix and BuildRequires: gtk-doc unbounded rather than\n  Oracle's \u003c= 1.25.1, which no i686 buildroot can satisfy\n- renumber the two TuxCare follow-up patches to Patch1011 and Patch1012; Oracle\n  took 1008 and 1009 for its own patches in this build\n- keep the CVE-2026-73433 and CVE-2026-73434 avidemux fixes from\n  1.10.4-2.0.5.tuxcare.els2, renumbered to Patch1013 and Patch1014 since\n  Oracle took 1010 in this build","status":"published","published":"2026-10-21T20:45:36Z","modified":"2026-10-26T09:31:43.809553358Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"USN-8863-1","title":"gst-plugins-good1.0 vulnerabilities","description":"Yazan Balawneh discovered that GStreamer Good Plugins incorrectly handled\ncertain FLAC audio streams. An attacker could possibly use this issue to\nobtain sensitive information. (CVE-2026-17072)\n\nSeonwook Kim discovered that GStreamer Good Plugins incorrectly parsed\ncertain AVI files. An attacker could possibly use this issue to cause a\ndenial of service or obtain sensitive information. (CVE-2026-73433)\n\nSeonwook Kim discovered that GStreamer Good Plugins did not correctly parse\ncertain AVI files. An attacker could possibly use this issue to cause a\ndenial of service. (CVE-2026-73434)\n\nSeonwook Kim discovered that GStreamer Good Plugins incorrectly handled\ncertain closed caption data. An attacker could possibly use this issue to\nobtain sensitive information. This issue only affected Ubuntu 20.04 LTS,\nUbuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.\n(CVE-2026-88914)","status":"published","published":"2026-10-01T16:46:33Z","modified":"2026-10-02T05:57:29.444899723Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}