Description
GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the processing of RTP payload elements. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29787.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GStreamer | GStreamer | 99fde1184fe8b12d0721230941c1bf2080913183 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gst-plugins-good1.0 | 1.28.5-1 | — |
| Debian 13 | gst-plugins-good1.0 | No fix yet | — |
| Debian 12 | gst-plugins-good1.0 | 1.22.0-5+deb12u4 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | gst-plugins-good1.0 | 1.28.2-2ubuntu0.3 | USN-8798-1 |
| Ubuntu 24.04 LTS | gst-plugins-good1.0 | 1.24.2-1ubuntu1.7 | USN-8798-1 |
| Ubuntu 22.04 LTS | gst-plugins-good1.0 | 1.20.3-0ubuntu1.9 | USN-8798-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | gst-plugins-good1.0 | 1.16.3-0ubuntu1.3+esm3 | USN-8798-1 |
| Ubuntu Pro 18.04 LTS | gst-plugins-good1.0 | 1.14.5-0ubuntu1~18.04.3+esm3 | USN-8798-1 |
| Ubuntu Pro 16.04 LTS | gst-plugins-good1.0 | 1.8.3-1ubuntu0.5+esm3 | USN-8798-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | gstreamer1-plugins-good +1 | 1.26.7-2.el10_2.8 | RHSA-2026:59972 |
| RHEL 9 | gstreamer1-plugins-good +1 | 1.22.12-7.el9_8.8 | RHSA-2026:59152 |
| RHEL 8 | gstreamer1-plugins-good +1 | 1.16.1-7.el8_10.7 | RHSA-2026:59179 |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | gstreamer1-plugins-good +1 | 1.24.11-1.el10_0.7 | RHSA-2026:71650 |
| RHEL 9.6 EUS | gstreamer1-plugins-good +1 | 1.22.12-5.el9_6.6 | RHSA-2026:71648 |
| RHEL 9.4 E4S | gstreamer1-plugins-good +1 | 1.22.1-4.el9_4.6 | RHSA-2026:71647 |
| RHEL 9.2 E4S | gstreamer1-plugins-good +1 | 1.18.4-8.el9_2.6 | RHSA-2026:71646 |
| RHEL 8.8 TUS | gstreamer1-plugins-good +1 | 1.16.1-5.el8_8.6 | RHSA-2026:73040 |
| RHEL 8.8 E4S | gstreamer1-plugins-good +1 | 1.16.1-5.el8_8.6 | RHSA-2026:73040 |
| RHEL 8.6 EUS Long Life | gstreamer1-plugins-good +1 | 1.16.1-4.el8_6.6 | RHSA-2026:72482 |
| RHEL 8.6 AUS | gstreamer1-plugins-good +1 | 1.16.1-4.el8_6.6 | RHSA-2026:72482 |
| RHEL 8.4 EUS Long Life | gstreamer1-plugins-good +1 | 1.16.1-4.el8_4.5 | RHSA-2026:73424 |
| RHEL 8.4 AUS | gstreamer1-plugins-good +1 | 1.16.1-4.el8_4.5 | RHSA-2026:73424 |
| RHEL 7 ELS | gstreamer1-plugins-good | 1.10.4-4.el7_9.6 | RHSA-2026:72367 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | gstreamer1-plugins-good +1 | 1.26.7-2.el10_2.8 | ALSA-2026:59972 |
| AlmaLinux 9 | gstreamer1-plugins-good +1 | 1.22.12-7.el9_8.8 | ALSA-2026:59152 |
| AlmaLinux 8 | gstreamer1-plugins-good +1 | 1.16.1-7.el8_10.7 | ALSA-2026:59179 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | gstreamer1-plugins-good | 1.26.7-2.el10_2.8 | RLSA-2026:59972 |
| Rocky Linux 9 | gstreamer1-plugins-good | 1.22.12-7.el9_8.8 | RLSA-2026:59152 |
| Rocky Linux 8 | gstreamer1-plugins-good | 1.16.1-7.el8_10.7 | RLSA-2026:59179 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | gstreamer1-plugins-good +1 | 1.24.10-1.amzn2023.0.11 | ALAS2023-2026-3353 |
| Amazon Linux 2 | gstreamer1-plugins-good +1 | 1.18.4-6.amzn2.0.16 | ALAS2-2026-4086 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | gstreamer1-plugins-good +1 | 1.26.7-2.el10_2.8 | ELSA-2026-59972 |
| Oracle Linux 9 | gstreamer1-plugins-good +1 | 1.22.12-7.el9_8.8 | ELSA-2026-59152 |
| Oracle Linux 8 | gstreamer1-plugins-good +1 | 1.16.1-7.el8_10.7 | ELSA-2026-59179 |
| Oracle Linux 7 | gstreamer1-plugins-good | 1.10.4-2.0.7.el7_9 | ELSA-2026-72367 |
Advisories 25
- WID-SEC-2026-2259 GStreamer: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 9, 2026
- ALAS2-2026-4086 Important: gstreamer1-plugins-good security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- ALAS2023-2026-3353 Important: gstreamer1-plugins-good security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 2, 2026
- ALSA-2026:59152 Important: gstreamer1-plugins-good security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:59972 Important: gstreamer1-plugins-good security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:59179 Important: gstreamer1-plugins-good security update AlmaLinux Security Advisories · Oct 29, 2026
- ELSA-2026-72367 Important: gstreamer1-plugins-good security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 14, 2026
- RHSA-2026:73424 Red Hat Security Advisory: gstreamer1-plugins-good security update Red Hat Security Advisories (RHSA) · Sep 30, 2026
- RHSA-2026:73040 Red Hat Security Advisory: gstreamer1-plugins-good security update Red Hat Security Advisories (RHSA) · Sep 30, 2026
- RHSA-2026:72482 Red Hat Security Advisory: gstreamer1-plugins-good security update Red Hat Security Advisories (RHSA) · Sep 30, 2026
- RHSA-2026:72367 Red Hat Security Advisory: gstreamer1-plugins-good security update Red Hat Security Advisories (RHSA) · Sep 30, 2026
- RHSA-2026:71648 Red Hat Security Advisory: gstreamer1-plugins-good security update Red Hat Security Advisories (RHSA) · Sep 30, 2026
- RHSA-2026:71650 Red Hat Security Advisory: gstreamer1-plugins-good security update Red Hat Security Advisories (RHSA) · Sep 30, 2026
- RHSA-2026:71646 Red Hat Security Advisory: gstreamer1-plugins-good security update Red Hat Security Advisories (RHSA) · Sep 30, 2026
- RHSA-2026:71647 Red Hat Security Advisory: gstreamer1-plugins-good security update Red Hat Security Advisories (RHSA) · Sep 30, 2026
- RHSA-2026:59972 Red Hat Security Advisory: gstreamer1-plugins-good security update Red Hat Security Advisories (RHSA) · Sep 30, 2026
- RHSA-2026:59152 Red Hat Security Advisory: gstreamer1-plugins-good security update Red Hat Security Advisories (RHSA) · Sep 30, 2026
- RHSA-2026:59179 Red Hat Security Advisory: gstreamer1-plugins-good security update Red Hat Security Advisories (RHSA) · Sep 30, 2026
- USN-8798-1 gst-plugins-good1.0 vulnerabilities Ubuntu Security Notices (USN) · Sep 22, 2026
- RLSA-2026:59972 Important: gstreamer1-plugins-good security update Rocky Linux Security Advisories · Aug 26, 2026
- RLSA-2026:59152 Important: gstreamer1-plugins-good security update Rocky Linux Security Advisories · Aug 26, 2026
- RLSA-2026:59179 Important: gstreamer1-plugins-good security update Rocky Linux Security Advisories · Aug 26, 2026
- ELSA-2026-59972 Important: gstreamer1-plugins-good security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Aug 26, 2026
- ELSA-2026-59179 Important: gstreamer1-plugins-good security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 24, 2026
- ELSA-2026-59152 Important: gstreamer1-plugins-good security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 24, 2026
References
- ZDI-26-467
- vendor-provided URL vendor-advisory