Loading story…
Red Hat released Important security updates for gstreamer1-plugins-base on Red Hat Enterprise Linux 8 and 10 to remediate CVE-2026-18297, a stack-based buffer overflow in GStreamer’s OGG-file parser. Improper validation of attacker-controlled data length before copying it into a stack buffer can allow arbitrary code execution in the context of the application processing the file.
Exploitation requires user interaction, such as opening a malicious OGG file or visiting a page that causes vulnerable GStreamer components to parse one; no public exploits were reported. Organizations should deploy RHSA-2026:59487 on RHEL 8, which supplies gstreamer1-plugins-base-1.16.1-6.el8_10.1, and RHSA-2026:59097 on RHEL 10, which supplies 1.26.7-2.el10_2.1, across affected x86_64, aarch64, ppc64le, and s390x systems.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
Miracle Linux published advisory AXSA-2026-1683 for Miracle Linux 8, addressing CVE-2026-18297 in gstreamer1-plugins-base and gstreamer1-plugins-base-devel. The advisory provides an official fix and states that no known exploits are available.
Rocky Linux published security advisory RLSA-2026-59487 for Rocky Linux 8, addressing CVE-2026-18297 in gstreamer1-plugins-base packages, including development and debug variants. The advisory states that no known exploits were available.
Oracle Linux published security advisory ELSA-2026-59487 for Oracle Linux 8, addressing CVE-2026-18297 in gstreamer1-plugins-base and gstreamer1-plugins-base-devel. The assessment reported no known exploits.
Red Hat issued Important-rated RHSA-2026:59487 for RHEL 8 and applicable RHEL 8.10 Extended Life Cycle systems, addressing CVE-2026-18297. The update supplied gstreamer1-plugins-base version 1.16.1-6.el8_10.1.
Red Hat issued Important-rated RHSA-2026:59097 for RHEL 10, fixing CVE-2026-18297 in gstreamer1-plugins-base. Fixed version 1.26.7-2.el10_2.1 was provided for x86_64, s390x, ppc64le, and aarch64 deployments.
CVE-2026-18297, a GStreamer OGG-file parsing buffer overflow that can allow arbitrary code execution, was published. The flaw is categorized as CWE-120 and exploitation requires a victim to open a malicious OGG file or visit a malicious page.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
7 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourceaccess.redhat.com
Open sourcetenable.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** security updates for `gstreamer1-plugins-good` to fix multiple remote code execution vulnerabilities in GStreamer affecting Red Hat Enterprise Linux 8, 9, and 10. The flaws include **CVE-2026-18295** and **CVE-2026-18296**, both tied to MRF file parsing, **CVE-2026-18298**, a heap-based buffer overflow in PNG parsing, and **CVE-2026-18299**, a use-after-free in the `rtpsbcdepay` component. Red Hat said the bugs could allow arbitrary code execution in the context of the current process after user interaction, such as opening a malicious file or visiting a crafted page, and noted the issues were tracked by ZDI as `ZDI-CAN-29510`, `ZDI-CAN-29608`, `ZDI-CAN-29581`, and `ZDI-CAN-29787`. The fixes were shipped through advisories **RHSA-2026:59179** for RHEL 8, **RHSA-2026:59152** for RHEL 9, and **RHSA-2026:59133** for RHEL 10. Red Hat published updated package builds `1.16.1-7.el8_10.7` for RHEL 8, `1.22.12-7.el9_8.8` for RHEL 9, and `1.26.7-2.el10_2.7` for RHEL 10 across multiple architectures and lifecycle channels. RHEL 10 addresses the PNG and one MRF heap overflow issue, while RHEL 8 and RHEL 9 updates cover the broader set of four GStreamer RCE vulnerabilities.
Sep 1, 2026
Red Hat released an **Important** update for `gstreamer1-plugins-good` on Red Hat Enterprise Linux 8, addressing four vulnerabilities—`CVE-2026-18295`, `CVE-2026-18296`, `CVE-2026-18298`, and `CVE-2026-18299`—that could permit remote code execution when vulnerable media content is processed. The defects affect MRF parsing, including a heap-based buffer overflow, PNG parsing with another heap-based buffer overflow, and a use-after-free condition in `rtpsbcdepay`; memory-corruption flaws of this type can cause application crashes or enable execution of attacker-controlled code. The fixed RHEL 8 packages are version `1.16.1-7.el8_10.7`, released for multiple architectures and RHEL 8.10 Extended Life Cycle variants. AlmaLinux 8 issued the corresponding `ALSA-2026:59179` update for `gstreamer1-plugins-good` and `gstreamer1-plugins-good-gtk`; Nessus reports high potential confidentiality, integrity, and availability impact, though no known public exploits were available. Organizations should identify affected local packages and apply the vendor updates promptly, especially on systems that process untrusted audio, video, image, or RTP media streams.
Aug 25, 2026
Red Hat released multiple **Important** security advisories for `gstreamer1-plugins-bad-free` across **Red Hat Enterprise Linux 9 and 10**, fixing two GStreamer vulnerabilities tracked as **`CVE-2026-59691`** and **`CVE-2026-59692`**. The first flaw is a heap out-of-bounds write in `rfbsrc/librfb` Hextile handling when processing a **16bpp framebuffer**, while the second is a stack buffer overflow in `openssl_verify_callback` tied to a **DTLS certificate Subject DN**. The advisories cover standard and extended support channels, including RHEL 9.4, 9.6, 9.8, and RHEL 10.0 product variants. Updated packages were issued for multiple architectures, including **`x86_64`**, **`aarch64`**, **`ppc64le`**, and **`s390x`**, with package versions including `1.22.1-6.el9_4.6`, `1.22.12-5.el9_6.6`, `1.22.12-7.el9_8.3`, `1.24.11-3.el10_0.6`, and `1.26.7-2.el10_2.6`. Affected offerings also include **Extended Update Support**, **Extended Life Cycle**, **SAP Solutions update services**, **4-years-of-updates/support variants**, and **CodeReady Linux Builder** repositories. Red Hat instructed customers to apply the updated packages through standard patching processes to remediate affected systems.
Aug 20, 2026