Red Hat Security Advisory: gstreamer1-plugins-good security update

Fixed packages 2

Vulnerabilities 3

• High 7.5
  CVE-2026-18649 Public exploit

  Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloaders

  A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacke…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu
  Aug 6, 2026
• Medium 6.6
  CVE-2026-73433

  Gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux fujifilm strd parsing leading to out-of-bounds read/write

  A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets (98 and 10 bytes) without verifying sufficient data remains. For …

  Red Hat GStreamer Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu
  Aug 12, 2026
• Medium 6.1
  CVE-2026-73434

  Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing

  A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp->fields value, ra…

  Red Hat GStreamer Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu
  Aug 12, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2510614
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2514801
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2514807
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70264.json
• report
  https://access.redhat.com/security/cve/CVE-2026-18649
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-18649
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-18649
• article
  https://0xsemizzz.vercel.app/projects/cve-2026-18649-gstreamer-rtp-dos/
• article
  https://github.com/0xSemizzz/CVE-2026-18649
• article
  https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/113
• report
  https://access.redhat.com/security/cve/CVE-2026-73433
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-73433
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-73433
• article
  https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231
• article
  https://gstreamer.freedesktop.org/security/sa-2026-0072.html
• report
  https://access.redhat.com/security/cve/CVE-2026-73434
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-73434
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-73434