Loading story…
Red Hat released multiple Important security advisories for gstreamer1-plugins-bad-free across Red Hat Enterprise Linux 9 and 10, fixing two GStreamer vulnerabilities tracked as CVE-2026-59691 and CVE-2026-59692. The first flaw is a heap out-of-bounds write in rfbsrc/librfb Hextile handling when processing a 16bpp framebuffer, while the second is a stack buffer overflow in openssl_verify_callback tied to a DTLS certificate Subject DN. The advisories cover standard and extended support channels, including RHEL 9.4, 9.6, 9.8, and RHEL 10.0 product variants.
Updated packages were issued for multiple architectures, including x86_64, aarch64, ppc64le, and s390x, with package versions including 1.22.1-6.el9_4.6, 1.22.12-5.el9_6.6, 1.22.12-7.el9_8.3, 1.24.11-3.el10_0.6, and 1.26.7-2.el10_2.6. Affected offerings also include Extended Update Support, Extended Life Cycle, SAP Solutions update services, 4-years-of-updates/support variants, and CodeReady Linux Builder repositories. Red Hat instructed customers to apply the updated packages through standard patching processes to remediate affected systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On 2026-08-13, Red Hat published RHSA-2026:54660, an Important advisory for gstreamer1-plugins-bad-free on Red Hat Enterprise Linux 9.6 Extended Update Support and related channels. The update released version 1.22.12-5.el9_6.6 and remediated CVE-2026-59691 and CVE-2026-59692.
On 2026-08-13, Red Hat published RHSA-2026:54659, an Important advisory for gstreamer1-plugins-bad-free on Red Hat Enterprise Linux 10.0 Extended Update Support and related channels. The update released version 1.24.11-3.el10_0.6 and fixed CVE-2026-59691 and CVE-2026-59692 across multiple architectures.
On 2026-08-13, Red Hat published RHSA-2026:54658, an Important advisory for gstreamer1-plugins-bad-free in RHEL 9.4 offerings including SAP Solutions and Extended Life Cycle channels. The update released version 1.22.1-6.el9_4.6 to fix CVE-2026-59691 and CVE-2026-59692.
On 2026-07-28, Red Hat published RHSA-2026:47180, an Important advisory for gstreamer1-plugins-bad-free on Red Hat Enterprise Linux 10. The update released package version 1.26.7-2.el10_2.6 and addressed CVE-2026-59691 and CVE-2026-59692 for RHEL 10 and related channels.
On 2026-07-28, Red Hat published RHSA-2026:47179, an Important security advisory for gstreamer1-plugins-bad-free on Red Hat Enterprise Linux 9. The update released version 1.22.12-7.el9_8.3 and fixed CVE-2026-59691 and CVE-2026-59692 across multiple RHEL 9 channels and architectures.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat has released **Important** security updates for `gstreamer1-plugins-bad-free` to address two flaws in GStreamer’s `gst-plugins-bad` package: `CVE-2026-59691` and `CVE-2026-59692`. The first bug affects the `rfbsrc` plugin’s bundled `librfb` code, where a malicious RFB/VNC server can trigger a heap out-of-bounds write during Hextile decoding when a 16bpp RGB565 framebuffer is advertised. The second affects the DTLS plugin, where `openssl_verify_callback()` reads an oversized certificate Subject DN into a fixed 2048-byte stack buffer during handshake processing, allowing a remote DTLS peer to crash the client with a crafted certificate. The vulnerabilities were reproduced on GStreamer `1.28.3` and are slated for upstream correction in `1.28.5`, with tracking advisories `GST-SA-2026-0063` and `GST-SA-2026-0062`. Red Hat shipped remediations across multiple supported product lines, including RHEL 7 ELS, RHEL 8, RHEL 8.4/8.6/8.8 specialized channels, and RHEL 9.2 SAP-related offerings, through advisories including `RHSA-2026:47731`, `RHSA-2026:54664`, `RHSA-2026:54665`, `RHSA-2026:54752`, `RHSA-2026:56658`, and `RHSA-2026:56772`. Red Hat’s analysis indicates the DTLS flaw is most likely to result in denial of service rather than code execution, while the `rfbsrc` issue can cause heap corruption and process aborts when connecting to a hostile server.
Aug 20, 2026
Red Hat released updated `gstreamer1-plugins-good` packages for RHEL 8 to fix three vulnerabilities, including **CVE-2026-18649**, an unbounded memory growth flaw in the `rtph264depay` and `rtph265depay` RTP depayloaders. The bug lets an attacker send a start fragment followed by an unlimited stream of continuation fragments, causing the `GstAdapter` reassembly buffer to grow without a maximum size until process memory is exhausted. Red Hat rated the advisory **Moderate** and said corresponding fixes were also issued for RHEL 9 and RHEL 10. The same update also addresses **CVE-2026-73433**, an unsigned integer underflow in avidemux FUJIFILM `strd` parsing that can lead to out-of-bounds read/write, and **CVE-2026-73434**, an out-of-bounds read in avidemux `vprp` video field descriptor parsing. Downstream tracking shows AlmaLinux 8 shipped matching fixes under `ALSA-2026:56966`, and Nessus coverage notes the package update applies across multiple repository variants. The weaknesses map to well-known classes including uncontrolled resource consumption (`CWE-770`) and out-of-bounds read (`CWE-125`), underscoring denial-of-service and memory-safety risk in media parsing components.
Aug 20, 2026
Red Hat released multiple **Important** security advisories for `containernetworking-plugins`, `skopeo`, and `git-lfs` across RHEL 9 and RHEL 10 channels after upstream Go vulnerabilities exposed those packages to denial-of-service, memory exhaustion, and TLS validation risks. The updates address `CVE-2025-61729` in Go's `crypto/x509`, `CVE-2025-61726` in `net/url` query parsing, and `CVE-2025-68121` in `crypto/tls`; newer `containernetworking-plugins` advisories also include `CVE-2026-25679`, an IPv6 host literal parsing flaw in `net/url`. Affected product streams include RHEL 9, RHEL 9.2 SAP-related channels, RHEL 9.6 EUS and associated service variants, and RHEL 10 update channels on `x86_64`, `aarch64`, `ppc64le`, and `s390x`. Upstream Go disclosures show the most prominent issue, `CVE-2025-61729`, can drive excessive CPU use during certificate hostname verification through inefficient handling in `crypto/x509`, including repeated hostname splitting and costly string processing in verification paths such as `Certificate.Verify` and `VerifyHostname`. Red Hat shipped fixed builds including `containernetworking-plugins` `1.7.1-3.el9_7`, `1.6.2-3.el9_6`, and `1.2.0-3.el9_2.3`, `skopeo` `1.20.0-3.el10_1`, and `git-lfs` `3.6.1-2.el10_0.2`, and urged customers to apply the updates to reduce exposure in container networking and software supply chain workflows.
Aug 20, 2026