Description
A vulnerability was found in the GStreamer RealMedia demuxer (gst-plugins-ugly). When processing a RealMedia (.rm) file, the demuxer parses MDPR (media properties) chunks to configure audio streams. For audio stream header versions 4 and 5, the parser reads fields such as codec type, packet size, sample rate, channel count, and extra codec data length from fixed offsets within the chunk without first checking that the chunk contains enough data. If a malicious file provides an MDPR chunk that is too small to contain a complete audio stream header, the parser reads beyond the end of the buffer. This can cause the application to crash. In some cases, bytes read past the buffer boundary may be incorporated into stream metadata, which could result in limited information disclosure.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gst-plugins-ugly1.0 | 1.28.4-1 | — |
| Debian 13 | gst-plugins-ugly1.0 | No fix yet | — |
| Debian 12 | gst-plugins-ugly1.0 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | gst-plugins-ugly1.0 | No fix yet | — |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | gst-plugins-ugly1.0 | 1.28.2-1ubuntu0.1~esm1 | USN-8896-1 |
| Ubuntu Pro 24.04 LTS | gst-plugins-ugly1.0 | 1.24.1-1ubuntu0.1~esm1 | USN-8896-1 |
| Ubuntu Pro 22.04 LTS | gst-plugins-ugly1.0 | 1.20.1-1ubuntu0.1~esm1 | USN-8896-1 |
| Ubuntu Pro 20.04 LTS | gst-plugins-ugly1.0 | 1.16.2-2ubuntu0.1~esm1 | USN-8896-1 |
| Ubuntu Pro 18.04 LTS | gst-plugins-ugly1.0 | 1.14.5-0ubuntu1~18.04.1+esm1 | USN-8896-1 |
| Ubuntu Pro 16.04 LTS | gst-plugins-ugly1.0 | 1.8.3-1ubuntu0.1+esm2 | USN-8896-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | gstreamer1-plugins-ugly-free | 1.26.7-2.el10_2.1 | RHSA-2026:36673 |
| RHEL 9 | gstreamer1-plugins-ugly-free | 1.22.12-6.el9_8.1 | RHSA-2026:36674 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | gstreamer1-plugins-ugly-free | 1.24.11-1.el10_0.2 | RHSA-2026:50688 |
| RHEL 9.6 EUS | gstreamer1-plugins-ugly-free | 1.22.12-4.el9_6.1 | RHSA-2026:50691 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | gstreamer1-plugins-ugly-free | 1.26.7-2.el10_2.1 | ALSA-2026:36673 |
| AlmaLinux 9 | gstreamer1-plugins-ugly-free | 1.22.12-6.el9_8.1 | ALSA-2026:36674 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | gstreamer1-plugins-ugly-free | 1.26.7-2.el10_2.1 | RLSA-2026:36673 |
| Rocky Linux 9 | gstreamer1-plugins-ugly-free | 1.22.12-6.el9_8.1 | RLSA-2026:36674 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | gstreamer1-plugins-ugly-free | 1.26.7-2.el10_2.1 | ELSA-2026-36673 |
| Oracle Linux 9 | gstreamer1-plugins-ugly-free | 1.22.12-6.el9_8.1 | ELSA-2026-36674 |
Advisories 12
- ALSA-2026:36673 Moderate: gstreamer1-plugins-ugly-free security update AlmaLinux Security Advisories · Nov 6, 2026
- ALSA-2026:36674 Moderate: gstreamer1-plugins-ugly-free security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-1919 GStreamer: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 15, 2026
- USN-8896-1 gst-plugins-ugly1.0 vulnerabilities Ubuntu Security Notices (USN) · Oct 8, 2026
- RHSA-2026:36673 Red Hat Security Advisory: gstreamer1-plugins-ugly-free security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2026:50691 Red Hat Security Advisory: gstreamer1-plugins-ugly-free security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2026:50688 Red Hat Security Advisory: gstreamer1-plugins-ugly-free security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2026:36674 Red Hat Security Advisory: gstreamer1-plugins-ugly-free security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- ELSA-2026-36673 Moderate: gstreamer1-plugins-ugly-free security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 16, 2026
- RLSA-2026:36674 Moderate: gstreamer1-plugins-ugly-free security update Rocky Linux Security Advisories · Jul 10, 2026
- RLSA-2026:36673 Moderate: gstreamer1-plugins-ugly-free security update Rocky Linux Security Advisories · Jul 10, 2026
- ELSA-2026-36674 Moderate: gstreamer1-plugins-ugly-free security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 8, 2026
References
- RHSA-2026:36673 vendor-advisory
- RHSA-2026:36674 vendor-advisory
- RHSA-2026:50688 vendor-advisory
- RHSA-2026:50691 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-53703 vdb-entry
- RHBZ#2487613 issue-tracking