Summary
It was discovered that GStreamer Good Plugins incorrectly parsed certain
MRF files. A remote attacker could possibly use this issue to execute
arbitrary code. (CVE-2026-18295, CVE-2026-18296)
It was discovered that GStreamer Good Plugins incorrectly parsed certain
PNG files. A remote attacker could possibly use this issue to execute
arbitrary code. (CVE-2026-18298)
DongHyeon Hwang discovered that GStreamer Good Plugins incorrectly
handled certain RTP packets. A remote attacker could possibly use this
issue to execute arbitrary code. (CVE-2026-18299)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | gst-plugins-good1.0 | 1.20.3-0ubuntu1.9 |
| Ubuntu · 24.04 LTS 24.04:LTS | gst-plugins-good1.0 | 1.24.2-1ubuntu1.7 |
| Ubuntu · 26.04 LTS 26.04:LTS | gst-plugins-good1.0 | 1.28.2-2ubuntu0.3 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | gst-plugins-good1.0 | 1.8.3-1ubuntu0.5+esm3 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | gst-plugins-good1.0 | 1.14.5-0ubuntu1~18.04.3+esm3 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | gst-plugins-good1.0 | 1.16.3-0ubuntu1.3+esm3 |
Vulnerabilities 4
-
High 7.8
GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that…
-
High 7.8
GStreamer MRF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
GStreamer MRF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability …
-
High 7.8
GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability …
-
High 7.8
GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability
GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but …