Loading story…
Red Hat released an Important update for gstreamer1-plugins-good on Red Hat Enterprise Linux 8, addressing four vulnerabilities—CVE-2026-18295, CVE-2026-18296, CVE-2026-18298, and CVE-2026-18299—that could permit remote code execution when vulnerable media content is processed. The defects affect MRF parsing, including a heap-based buffer overflow, PNG parsing with another heap-based buffer overflow, and a use-after-free condition in rtpsbcdepay; memory-corruption flaws of this type can cause application crashes or enable execution of attacker-controlled code.
The fixed RHEL 8 packages are version 1.16.1-7.el8_10.7, released for multiple architectures and RHEL 8.10 Extended Life Cycle variants. AlmaLinux 8 issued the corresponding ALSA-2026:59179 update for gstreamer1-plugins-good and gstreamer1-plugins-good-gtk; Nessus reports high potential confidentiality, integrity, and availability impact, though no known public exploits were available. Organizations should identify affected local packages and apply the vendor updates promptly, especially on systems that process untrusted audio, video, image, or RTP media streams.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
AlmaLinux published security advisory ALSA-2026:59179 for AlmaLinux 8 packages gstreamer1-plugins-good and gstreamer1-plugins-good-gtk, addressing the same four GStreamer CVEs. The associated Nessus entry reported no known exploits available.
Red Hat issued Important advisory RHSA-2026:59179 for RHEL 8, releasing gstreamer1-plugins-good version 1.16.1-7.el8_10.7. The update fixes CVE-2026-18295, CVE-2026-18296, CVE-2026-18298, and CVE-2026-18299, including heap overflows and a use-after-free that could permit remote code execution.
Four GStreamer vulnerabilities—CVE-2026-18295, CVE-2026-18296, CVE-2026-18298, and CVE-2026-18299—were published. They affect MRF and PNG parsing and the rtpsbcdepay component, with potential remote code execution impact.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourceaccess.redhat.com
Open sourcecwe.mitre.org
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released updated `gstreamer1-plugins-good` packages for RHEL 8 to fix three vulnerabilities, including **CVE-2026-18649**, an unbounded memory growth flaw in the `rtph264depay` and `rtph265depay` RTP depayloaders. The bug lets an attacker send a start fragment followed by an unlimited stream of continuation fragments, causing the `GstAdapter` reassembly buffer to grow without a maximum size until process memory is exhausted. Red Hat rated the advisory **Moderate** and said corresponding fixes were also issued for RHEL 9 and RHEL 10. The same update also addresses **CVE-2026-73433**, an unsigned integer underflow in avidemux FUJIFILM `strd` parsing that can lead to out-of-bounds read/write, and **CVE-2026-73434**, an out-of-bounds read in avidemux `vprp` video field descriptor parsing. Downstream tracking shows AlmaLinux 8 shipped matching fixes under `ALSA-2026:56966`, and Nessus coverage notes the package update applies across multiple repository variants. The weaknesses map to well-known classes including uncontrolled resource consumption (`CWE-770`) and out-of-bounds read (`CWE-125`), underscoring denial-of-service and memory-safety risk in media parsing components.
Sep 1, 2026
Red Hat released **Important** security updates for `gstreamer1-plugins-good` to fix multiple remote code execution vulnerabilities in GStreamer affecting Red Hat Enterprise Linux 8, 9, and 10. The flaws include **CVE-2026-18295** and **CVE-2026-18296**, both tied to MRF file parsing, **CVE-2026-18298**, a heap-based buffer overflow in PNG parsing, and **CVE-2026-18299**, a use-after-free in the `rtpsbcdepay` component. Red Hat said the bugs could allow arbitrary code execution in the context of the current process after user interaction, such as opening a malicious file or visiting a crafted page, and noted the issues were tracked by ZDI as `ZDI-CAN-29510`, `ZDI-CAN-29608`, `ZDI-CAN-29581`, and `ZDI-CAN-29787`. The fixes were shipped through advisories **RHSA-2026:59179** for RHEL 8, **RHSA-2026:59152** for RHEL 9, and **RHSA-2026:59133** for RHEL 10. Red Hat published updated package builds `1.16.1-7.el8_10.7` for RHEL 8, `1.22.12-7.el9_8.8` for RHEL 9, and `1.26.7-2.el10_2.7` for RHEL 10 across multiple architectures and lifecycle channels. RHEL 10 addresses the PNG and one MRF heap overflow issue, while RHEL 8 and RHEL 9 updates cover the broader set of four GStreamer RCE vulnerabilities.
Sep 1, 2026
Red Hat released multiple **Important** security advisories for `gstreamer1-plugins-bad-free` across **Red Hat Enterprise Linux 9 and 10**, fixing two GStreamer vulnerabilities tracked as **`CVE-2026-59691`** and **`CVE-2026-59692`**. The first flaw is a heap out-of-bounds write in `rfbsrc/librfb` Hextile handling when processing a **16bpp framebuffer**, while the second is a stack buffer overflow in `openssl_verify_callback` tied to a **DTLS certificate Subject DN**. The advisories cover standard and extended support channels, including RHEL 9.4, 9.6, 9.8, and RHEL 10.0 product variants. Updated packages were issued for multiple architectures, including **`x86_64`**, **`aarch64`**, **`ppc64le`**, and **`s390x`**, with package versions including `1.22.1-6.el9_4.6`, `1.22.12-5.el9_6.6`, `1.22.12-7.el9_8.3`, `1.24.11-3.el10_0.6`, and `1.26.7-2.el10_2.6`. Affected offerings also include **Extended Update Support**, **Extended Life Cycle**, **SAP Solutions update services**, **4-years-of-updates/support variants**, and **CodeReady Linux Builder** repositories. Red Hat instructed customers to apply the updated packages through standard patching processes to remediate affected systems.
Aug 20, 2026