From e3fa46713dac7b27aeec30f526ca341d3201960e Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Tue, 25 Aug 2026 07:13:42 +0000 Subject: [PATCH] Fix CVE-2026-18297: opusdec channel position overflow Backport upstream fix (GStreamer MR !12044) for CVE-2026-18297 to gstreamer1-plugins-base-1.16.1. The patch adds a guard in gst_opus_dec_negotiate() to avoid using channel positions when there are more than 64 channels, which is unsupported. The patch paths were adjusted from the upstream monorepo layout to the standalone 1.16.1 source tree. CVE: CVE-2026-18297 Upstream patches: - https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12044.patch Resolves: RHEL-246576 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- ...1-plugins-base-1.16.1-CVE-2026-18297.patch | 27 +++++++++++++++++++ gstreamer1-plugins-base.spec | 10 ++++++- 2 files changed, 36 insertions(+), 1 deletion(-) create mode 100644 gstreamer1-plugins-base-1.16.1-CVE-2026-18297.patch diff --git a/gstreamer1-plugins-base-1.16.1-CVE-2026-18297.patch b/gstreamer1-plugins-base-1.16.1-CVE-2026-18297.patch new file mode 100644 index 0000000..4b42983 --- /dev/null +++ b/gstreamer1-plugins-base-1.16.1-CVE-2026-18297.patch @@ -0,0 +1,27 @@ +From 91d14fc6bff0da9d7931e4d048ca0119c05943bb Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Fri, 19 Jun 2026 13:48:16 +0300 +Subject: [PATCH] opusdec: Don't use any channel positions for >64 channels + +We don't support this. + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5122 + +Part-of: +--- + ext/opus/gstopusdec.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/ext/opus/gstopusdec.c b/ext/opus/gstopusdec.c +index 16b2a29..37980a4 100644 +--- a/ext/opus/gstopusdec.c ++++ b/ext/opus/gstopusdec.c +@@ -290,6 +290,8 @@ gst_opus_dec_negotiate (GstOpusDec * dec, const GstAudioChannelPosition * pos) + GST_DEBUG_OBJECT (dec, "Using a default of 2 channels"); + dec->n_channels = 2; + pos = NULL; ++ } else if (dec->n_channels > 64) { ++ pos = NULL; + } + + if (dec->sample_rate == 0) { diff --git a/gstreamer1-plugins-base.spec b/gstreamer1-plugins-base.spec index 62afa82..39924b6 100644 --- a/gstreamer1-plugins-base.spec +++ b/gstreamer1-plugins-base.spec @@ -6,7 +6,7 @@ Name: gstreamer1-plugins-base Version: 1.16.1 -Release: 6%{?gitcommit:.git%{shortcommit}}%{?dist} +Release: 6%{?gitcommit:.git%{shortcommit}}%{?dist}.1 Summary: GStreamer streaming media framework base plugins License: LGPLv2+ @@ -27,6 +27,9 @@ Patch5: 0006-opusdec-Set-at-most-64-channels-to-NONE-position.patch Patch6: 0007-vorbis_parse-check-writes-to-GstOggStream.vorbis_mod.patch Patch7: 0008-vorbisdec-Set-at-most-64-channels-to-NONE-position.patch Patch8: 0001-riff-Correctly-check-that-enough-RGB-palette-data-is.patch +# https://issues.redhat.com/browse/RHEL-246576 +# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12044 +Patch9: gstreamer1-plugins-base-1.16.1-CVE-2026-18297.patch BuildRequires: gcc-c++ BuildRequires: gstreamer1-devel >= %{version} @@ -130,6 +133,7 @@ for the GStreamer Base Plugins library. %patch6 -p1 %patch7 -p1 %patch8 -p1 +%patch9 -p1 %build # die rpath (method of modifying libtool fails here) @@ -497,6 +501,10 @@ chrpath --delete $RPM_BUILD_ROOT%{_bindir}/gst-play-1.0 %changelog +* Tue Aug 25 2026 RHEL Packaging Agent - 1.16.1-6.1 +- Add patch for CVE-2026-18297 + Resolves: RHEL-246576 + * Tue Mar 31 2026 Wim Taymans - 1.16.1-6 - Add patch for CVE-2026-2921 Resolves: RHEL-156169