Loading story…
Multiple critical vulnerabilities were disclosed in GStreamer, affecting several media parsers and demuxers including ASF, RealMedia, DVB Subtitles, JPEG, RIFF, H.265, and H.266. The issues include heap/stack buffer overflows, out-of-bounds writes, and integer overflows/underflows that can lead to denial of service or remote code execution when a user opens a crafted media file, with the most severe flaws identified as CVE-2026-3083 and CVE-2026-3085 in the rtpqdm2depay component. Belgian CCB warned that exploitation could expose sensitive data, compromise systems, and disrupt operations, and urged organizations to patch immediately.
Debian separately issued DSA-6167-1 for gst-plugins-base1.0, addressing CVE-2026-2921, an integer overflow in the RIFF parser that may cause a crash or potentially allow arbitrary code execution via a malformed media file. Debian released fixes for bookworm in version 1.22.0-3+deb12u6 and for trixie in version 1.26.2-1+deb13u1. The GIMP advisory is unrelated to this event because it covers a separate HDR file parsing heap-based buffer overflow, CVE-2026-2049, in a different product.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
The GStreamer project published stable release 1.28.2 with security fixes for at least 11 vulnerabilities across multiple parsers and demuxers. The issues included denial of service, heap and stack buffer overflows, integer overflows, out-of-bounds access, assertion failures, and NULL-pointer dereferences.
Debian issued security advisory DSA-6167-1 announcing a security update for gst-plugins-base1.0 to address the GStreamer-related vulnerabilities.
The Belgian Centre for Cybersecurity published an advisory warning about multiple critical vulnerabilities in GStreamer and urged users and organizations to patch immediately.
Zero Day Initiative reported CVE-2026-5056, a stack-based buffer overflow in GStreamer’s qtdemux component, to the vendor. The flaw could allow arbitrary code execution when parsing a crafted UncompressedFrameConfigBox structure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourcelists.debian.org
Open sourceccb.belgium.be
Open sourcezerodayinitiative.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released updated `gstreamer1-plugins-good` packages for RHEL 8 to fix three vulnerabilities, including **CVE-2026-18649**, an unbounded memory growth flaw in the `rtph264depay` and `rtph265depay` RTP depayloaders. The bug lets an attacker send a start fragment followed by an unlimited stream of continuation fragments, causing the `GstAdapter` reassembly buffer to grow without a maximum size until process memory is exhausted. Red Hat rated the advisory **Moderate** and said corresponding fixes were also issued for RHEL 9 and RHEL 10. The same update also addresses **CVE-2026-73433**, an unsigned integer underflow in avidemux FUJIFILM `strd` parsing that can lead to out-of-bounds read/write, and **CVE-2026-73434**, an out-of-bounds read in avidemux `vprp` video field descriptor parsing. Downstream tracking shows AlmaLinux 8 shipped matching fixes under `ALSA-2026:56966`, and Nessus coverage notes the package update applies across multiple repository variants. The weaknesses map to well-known classes including uncontrolled resource consumption (`CWE-770`) and out-of-bounds read (`CWE-125`), underscoring denial-of-service and memory-safety risk in media parsing components.
Aug 20, 2026
Red Hat released multiple **Important** security advisories for `gstreamer1-plugins-bad-free` across **Red Hat Enterprise Linux 9 and 10**, fixing two GStreamer vulnerabilities tracked as **`CVE-2026-59691`** and **`CVE-2026-59692`**. The first flaw is a heap out-of-bounds write in `rfbsrc/librfb` Hextile handling when processing a **16bpp framebuffer**, while the second is a stack buffer overflow in `openssl_verify_callback` tied to a **DTLS certificate Subject DN**. The advisories cover standard and extended support channels, including RHEL 9.4, 9.6, 9.8, and RHEL 10.0 product variants. Updated packages were issued for multiple architectures, including **`x86_64`**, **`aarch64`**, **`ppc64le`**, and **`s390x`**, with package versions including `1.22.1-6.el9_4.6`, `1.22.12-5.el9_6.6`, `1.22.12-7.el9_8.3`, `1.24.11-3.el10_0.6`, and `1.26.7-2.el10_2.6`. Affected offerings also include **Extended Update Support**, **Extended Life Cycle**, **SAP Solutions update services**, **4-years-of-updates/support variants**, and **CodeReady Linux Builder** repositories. Red Hat instructed customers to apply the updated packages through standard patching processes to remediate affected systems.
Aug 20, 2026
Red Hat has released **Important** security updates for `gstreamer1-plugins-bad-free` to address two flaws in GStreamer’s `gst-plugins-bad` package: `CVE-2026-59691` and `CVE-2026-59692`. The first bug affects the `rfbsrc` plugin’s bundled `librfb` code, where a malicious RFB/VNC server can trigger a heap out-of-bounds write during Hextile decoding when a 16bpp RGB565 framebuffer is advertised. The second affects the DTLS plugin, where `openssl_verify_callback()` reads an oversized certificate Subject DN into a fixed 2048-byte stack buffer during handshake processing, allowing a remote DTLS peer to crash the client with a crafted certificate. The vulnerabilities were reproduced on GStreamer `1.28.3` and are slated for upstream correction in `1.28.5`, with tracking advisories `GST-SA-2026-0063` and `GST-SA-2026-0062`. Red Hat shipped remediations across multiple supported product lines, including RHEL 7 ELS, RHEL 8, RHEL 8.4/8.6/8.8 specialized channels, and RHEL 9.2 SAP-related offerings, through advisories including `RHSA-2026:47731`, `RHSA-2026:54664`, `RHSA-2026:54665`, `RHSA-2026:54752`, `RHSA-2026:56658`, and `RHSA-2026:56772`. Red Hat’s analysis indicates the DTLS flaw is most likely to result in denial of service rather than code execution, while the `rfbsrc` issue can cause heap corruption and process aborts when connecting to a hostile server.
Aug 20, 2026