GStreamer: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• Medium 4.4
  CVE-2026-12892

  Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad: 1-byte heap out-of-bounds read in h.264 nal extension slice parser

  A flaw was found in GStreamer's gst-plugins-bad package. When processing a specially crafted H.264 video file containing malformed MVC or SVC extension slice NAL units, a 1-byte heap out-of-bounds read can occur during parsing. This happens when the parser at…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  Jun 23, 2026
• Medium 4.3
  CVE-2026-12891

  Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad: global buffer overflow (oob read) in h.266/vvc vui parameter parser

  A flaw was found in the GStreamer gst-plugins-bad package. When processing a malformed H.266/VVC video stream with a crafted aspect ratio indicator value, the H.266 parser performs an out-of-bounds read of up to 8 bytes from adjacent memory. This flaw allows …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu
  Jun 23, 2026

Revision history

1. 2026-10-15 #9

   Neue Updates von Debian aufgenommen

2. 2026-08-23 #8

   Neue Updates von Debian aufgenommen

3. 2026-08-04 #7

   Neue Updates von Amazon aufgenommen

4. 2026-07-27 #6

   Neue Updates von SUSE aufgenommen

5. 2026-07-22 #5

   Neue Updates von SUSE aufgenommen

6. 2026-07-20 #4

   Neue Updates von SUSE aufgenommen

7. 2026-07-15 #3

   Neue Updates von SUSE aufgenommen

8. 2026-06-24 #2

   Referenz(en) aufgenommen: GSTREAMER-SA-2026-0047, GSTREAMER-SA-2026-0048

9. 2026-06-23 #1

   Initiale Fassung

References

• NIST Vulnerability Database vom 2026-06-23
  https://nvd.nist.gov/vuln/detail/CVE-2026-12891
• NIST Vulnerability Database vom 2026-06-23
  https://nvd.nist.gov/vuln/detail/CVE-2026-12892
• RedHat Bugzilla vom 2026-06-23
  https://bugzilla.redhat.com/show_bug.cgi?id=2491318
• RedHat Bugzilla vom 2026-06-23
  https://bugzilla.redhat.com/show_bug.cgi?id=2491321
• Vulmon Advisory vom 2026-06-23
  https://www.vulmon.com/vulnerabilitydetails?qid=CVE-2026-12891
• Vulmon Advisory vom 2026-06-23
  https://www.vulmon.com/vulnerabilitydetails?qid=CVE-2026-12892
• SUSE Security Update SUSE-SU-2026:3058-1 vom 2026-07-15
  https://lists.suse.com/pipermail/sle-security-updates/2026-July/027532.html
• SUSE Security Update SUSE-SU-2026:3133-1 vom 2026-07-20
  https://lists.suse.com/pipermail/sle-security-updates/2026-July/027670.html
• SUSE Security Update SUSE-SU-2026:3125-1 vom 2026-07-20
  https://lists.suse.com/pipermail/sle-security-updates/2026-July/027623.html
• SUSE Security Update SUSE-SU-2026:22752-1 vom 2026-07-22
  https://lists.suse.com/pipermail/sle-security-updates/2026-July/027754.html
• SUSE Security Update SUSE-SU-2026:22817-1 vom 2026-07-27
  https://lists.suse.com/pipermail/sle-security-updates/2026-July/027924.html
• SUSE Security Update SUSE-SU-2026:3299-1 vom 2026-07-28
  https://lists.suse.com/pipermail/sle-security-updates/2026-July/027956.html
• Amazon Linux Security Advisory ALAS2-2026-3833 vom 2026-08-05
  https://alas.aws.amazon.com/AL2/ALAS2-2026-3833.html
• Debian Security Advisory DSA-6458 vom 2026-08-22
  https://security-tracker.debian.org/tracker/DSA-6458-1
• Debian Security Advisory DLA-4839 vom 2026-10-16
  https://lists.debian.org/debian-lts-announce/2026/10/msg00032.html