Backport upstream fix (GStreamer MR !12044) for
CVE-2026-18297 to gstreamer1-plugins-base-1.16.1.
The patch adds a guard in gst_opus_dec_negotiate() to avoid
using channel positions when there are more than 64 channels,
which is unsupported. The patch paths were adjusted from the
upstream monorepo layout to the standalone 1.16.1 source tree.
CVE: CVE-2026-18297
Upstream patches:
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12044.patch
Resolves: RHEL-246576
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
