Loading story…
Red Hat released updated gstreamer1-plugins-good packages for RHEL 8 to fix three vulnerabilities, including CVE-2026-18649, an unbounded memory growth flaw in the rtph264depay and rtph265depay RTP depayloaders. The bug lets an attacker send a start fragment followed by an unlimited stream of continuation fragments, causing the GstAdapter reassembly buffer to grow without a maximum size until process memory is exhausted. Red Hat rated the advisory Moderate and said corresponding fixes were also issued for RHEL 9 and RHEL 10.
The same update also addresses CVE-2026-73433, an unsigned integer underflow in avidemux FUJIFILM strd parsing that can lead to out-of-bounds read/write, and CVE-2026-73434, an out-of-bounds read in avidemux vprp video field descriptor parsing. Downstream tracking shows AlmaLinux 8 shipped matching fixes under ALSA-2026:56966, and Nessus coverage notes the package update applies across multiple repository variants. The weaknesses map to well-known classes including uncontrolled resource consumption (CWE-770) and out-of-bounds read (CWE-125), underscoring denial-of-service and memory-safety risk in media parsing components.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
A Tenable Nessus plugin for AlmaLinux 8 recorded that the patch for the gstreamer1-plugins-good vulnerabilities, including CVE-2026-18649, was published on 2026-08-19 and noted that exploits are available. The plugin tracks AlmaLinux advisory ALSA-2026:56966 derived from RHSA-2026:56966.
Red Hat published security advisory RHSA-2026:56966 for Red Hat Enterprise Linux 8, shipping updated gstreamer1-plugins-good packages that fix CVE-2026-18649 and two additional vulnerabilities. The advisory rated the update Moderate and published package version 1.16.1-7.el8_10.3.
Red Hat Bugzilla entry 2510614 described CVE-2026-18649 in gst-plugins-good, where rtph264depay and rtph265depay can grow memory without bounds during RTP fragment reassembly, leading to process memory exhaustion. The report notes the issue was confirmed by the GStreamer security team and reported by Yehia Ali Mohamed Ezzat.
A Nessus plugin for AlmaLinux states that CVE-2026-18649, along with related gstreamer1-plugins-good vulnerabilities, was published on 2026-08-06. The issue involves unbounded memory growth in GStreamer RTP depayloaders.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcecwe.mitre.org
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat has released **Important** security updates for `gstreamer1-plugins-bad-free` to address two flaws in GStreamer’s `gst-plugins-bad` package: `CVE-2026-59691` and `CVE-2026-59692`. The first bug affects the `rfbsrc` plugin’s bundled `librfb` code, where a malicious RFB/VNC server can trigger a heap out-of-bounds write during Hextile decoding when a 16bpp RGB565 framebuffer is advertised. The second affects the DTLS plugin, where `openssl_verify_callback()` reads an oversized certificate Subject DN into a fixed 2048-byte stack buffer during handshake processing, allowing a remote DTLS peer to crash the client with a crafted certificate. The vulnerabilities were reproduced on GStreamer `1.28.3` and are slated for upstream correction in `1.28.5`, with tracking advisories `GST-SA-2026-0063` and `GST-SA-2026-0062`. Red Hat shipped remediations across multiple supported product lines, including RHEL 7 ELS, RHEL 8, RHEL 8.4/8.6/8.8 specialized channels, and RHEL 9.2 SAP-related offerings, through advisories including `RHSA-2026:47731`, `RHSA-2026:54664`, `RHSA-2026:54665`, `RHSA-2026:54752`, `RHSA-2026:56658`, and `RHSA-2026:56772`. Red Hat’s analysis indicates the DTLS flaw is most likely to result in denial of service rather than code execution, while the `rfbsrc` issue can cause heap corruption and process aborts when connecting to a hostile server.
Aug 20, 2026
Red Hat released multiple **Important** security advisories for `gstreamer1-plugins-bad-free` across **Red Hat Enterprise Linux 9 and 10**, fixing two GStreamer vulnerabilities tracked as **`CVE-2026-59691`** and **`CVE-2026-59692`**. The first flaw is a heap out-of-bounds write in `rfbsrc/librfb` Hextile handling when processing a **16bpp framebuffer**, while the second is a stack buffer overflow in `openssl_verify_callback` tied to a **DTLS certificate Subject DN**. The advisories cover standard and extended support channels, including RHEL 9.4, 9.6, 9.8, and RHEL 10.0 product variants. Updated packages were issued for multiple architectures, including **`x86_64`**, **`aarch64`**, **`ppc64le`**, and **`s390x`**, with package versions including `1.22.1-6.el9_4.6`, `1.22.12-5.el9_6.6`, `1.22.12-7.el9_8.3`, `1.24.11-3.el10_0.6`, and `1.26.7-2.el10_2.6`. Affected offerings also include **Extended Update Support**, **Extended Life Cycle**, **SAP Solutions update services**, **4-years-of-updates/support variants**, and **CodeReady Linux Builder** repositories. Red Hat instructed customers to apply the updated packages through standard patching processes to remediate affected systems.
Aug 20, 2026
Multiple **critical vulnerabilities** were disclosed in **GStreamer**, affecting several media parsers and demuxers including **ASF, RealMedia, DVB Subtitles, JPEG, RIFF, H.265, and H.266**. The issues include **heap/stack buffer overflows, out-of-bounds writes, and integer overflows/underflows** that can lead to **denial of service** or **remote code execution** when a user opens a crafted media file, with the most severe flaws identified as **CVE-2026-3083** and **CVE-2026-3085** in the `rtpqdm2depay` component. Belgian CCB warned that exploitation could expose sensitive data, compromise systems, and disrupt operations, and urged organizations to patch immediately. Debian separately issued **DSA-6167-1** for `gst-plugins-base1.0`, addressing **CVE-2026-2921**, an **integer overflow** in the **RIFF parser** that may cause a crash or potentially allow arbitrary code execution via a malformed media file. Debian released fixes for **bookworm** in version `1.22.0-3+deb12u6` and for **trixie** in version `1.26.2-1+deb13u1`. The GIMP advisory is unrelated to this event because it covers a separate **HDR file parsing** heap-based buffer overflow, **CVE-2026-2049**, in a different product.
Jun 29, 2026