Summary
It was discovered that GStreamer Good Plugins did not properly handle
certain network streams. A remote attacker could possibly use this issue
to cause an application crash or execute arbitrary code. This issue only
affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2026-3083, CVE-2026-3085)
It was discovered that GStreamer Good Plugins incorrectly handled certain
Matroska files. An attacker could possibly use this issue to cause an
application crash, resulting in a denial of service. This issue only
affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2026-39043)
It was discovered that GStreamer Good Plugins incorrectly handled certain
WAV files. An attacker could possibly use this issue to make GStreamer
Good Plugins crash, resulting in a denial of service. This issue only
affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2026-39044)
It was discovered that GStreamer Good Plugins incorrectly handled certain
MP4 audio tracks. An attacker could possibly use this issue to cause an
application crash, resulting in a denial of service. This issue only
affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2026-46470)
It was discovered that GStreamer Good Plugins incorrectly handled certain
MP4 files. An attacker could possibly use this issue to make GStreamer Good
Plugins crash, resulting in a denial of service, or obtain sensitive
information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-46471)
It was discovered that GStreamer Good Plugins incorrectly handled certain
WavPack audio files. An attacker could possibly use this issue to cause an
application crash, resulting in a denial of service, or execute arbitrary
code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and
Ubuntu 20.04 LTS. (CVE-2026-53705)
It was discovered that GStreamer Good Plugins and GStreamer Base Plugins
incorrectly handled certain network streams. A remote attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. (CVE-2026-111183)
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | gst-plugins-base1.0 | 1.20.1-1ubuntu0.8 |
| Ubuntu · 22.04 LTS 22.04:LTS | gst-plugins-good1.0 | 1.20.3-0ubuntu1.11 |
| Ubuntu · 26.10 | gst-plugins-base1.0 | 1.28.7-1ubuntu0.1 |
| Ubuntu · 26.10 | gst-plugins-good1.0 | 1.28.7-1ubuntu0.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | gst-plugins-base1.0 | 1.8.3-1ubuntu0.3+esm6 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | gst-plugins-good1.0 | 1.8.3-1ubuntu0.5+esm5 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | gst-plugins-base1.0 | 1.14.5-0ubuntu1~18.04.3+esm5 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | gst-plugins-good1.0 | 1.14.5-0ubuntu1~18.04.3+esm5 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | gst-plugins-base1.0 | 1.16.3-0ubuntu1.4+esm4 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | gst-plugins-good1.0 | 1.16.3-0ubuntu1.3+esm5 |
Vulnerabilities 6
-
Critical 9.8
GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability
GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulner…
-
High 8.8
GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability
GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerabilit…
-
High 8.8
GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability
GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulne…
-
High 7.6
Gstreamer1-plugins-good: gstreamer: heap buffer overflow in wavpack decoder via integer overflow
A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very smal…
-
Medium 5.5
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtd…
-
Medium 4.0
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's…
References
-
report
https://ubuntu.com/security/CVE-2026-3083
-
report
https://ubuntu.com/security/CVE-2026-3085
-
report
https://ubuntu.com/security/CVE-2026-39043
-
report
https://ubuntu.com/security/CVE-2026-39044
-
report
https://ubuntu.com/security/CVE-2026-46470
-
report
https://ubuntu.com/security/CVE-2026-46471
-
report
https://ubuntu.com/security/CVE-2026-53705
-
report
https://ubuntu.com/security/CVE-2026-111183