RHEL-246869: the CVE-2026-73433 backport (Patch11) introduces two
calls to g_memdup2() in gst/avi/gstavidemux.c (gst_avi_demux_parse_strd
and gst_avi_demux_parse_ncdt). g_memdup2() was only added in GLib 2.68;
RHEL 8 ships GLib 2.56.4. Since GStreamer elements are dlopen-loaded
plugins, the missing symbol does not fail the build -- it fails at
plugin load time with 'undefined symbol: g_memdup2', silently
disabling the entire avi plugin (avidemux/avimux).
There is no upstream commit to backport for this: upstream's own
gst/glib-compat-private.h already provides this exact fallback macro
for builds against GLib < 2.67.4 (see commit b16e96dd87 in the
gstreamer monorepo), and meson wires it into config.h automatically.
That mechanism doesn't exist in this 1.16.1 autotools-based tree, so
add the same macro directly to gstavidemux.c ahead of its first use,
as an additional hunk appended to the existing CVE-2026-73433 patch.
This follows Option A from the Jira discussion (preferred by both the
Ymir triage agent and Wim Taymans), matching the exact mechanism
GStreamer itself uses rather than replacing g_memdup2 with a plain
g_memdup call.
Verified: applying the modified patch with "patch -p1" against a
pristine gst-plugins-good-1.16.1 source tree succeeds cleanly (exit 0,
no .rej files), with the compat macro defined before both g_memdup2
call sites.
Resolves: RHEL-246869
Backport upstream commit 93fa4cd30ba43b38b02a9de76a7a80dc198c87a0
(qtmoovrecover: Validate box sizes) to fix CVE-2026-18295 and
CVE-2026-18296. The patch adds box size validation and box version
checks to gst/isomp4/atomsrecovery.c. The upstream patch was adapted
from the GStreamer monorepo layout to match the standalone
gst-plugins-good-1.16.1 source tree.
CVE: CVE-2026-18295 CVE-2026-18296
Upstream patches:
- 93fa4cd30b.patch
Resolves: RHEL-246382
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream commit cf4f7cbc081cde7769862b424c105f10c083171b
to fix CVE-2026-18298, a heap buffer overflow in the GdkPixbuf
image decoder (gstgdkpixbufdec.c) caused by dimension changes.
The fix moves the n_channels/format determination before the
conditional check and extends the condition to also verify format,
width, and height changes, ensuring the video info is properly
reinitialized when image properties change.
CVE: CVE-2026-18298
Upstream patches:
- cf4f7cbc08.patch
Resolves: RHEL-246561
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream fix for CVE-2026-18299, a Use-After-Free
vulnerability in the RTP SBC depayloader (rtpsbcdepay). The fix
consists of three commits from upstream GStreamer MR !12042:
resetting buffers to NULL after giving away ownership, checking
adapter availability and minimum payload length, and removing
incorrect variable shadowing of `samples`.
CVE: CVE-2026-18299
Upstream patches:
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12042.patch
Resolves: RHEL-246618
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream commit 93fa4cd30ba4 to fix CVE-2026-18296.
The patch adds validation of box sizes and box versions in
atomsrecovery.c (qtmoovrecover), preventing potential security
issues. The upstream monorepo path prefix was stripped to fit
the standalone gst-plugins-good source tree used in RHEL 8.
Added as Patch14 following the existing CVE patch naming
convention.
CVE: CVE-2026-18296
Upstream patches:
- 93fa4cd30b.patch
Resolves: RHEL-246549
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream commit 0bcc6564 to fix an out-of-bounds read
vulnerability in the AVI demuxer (CVE-2026-73434). The fix
corrects the divisor used when calculating the available number
of vprp field infos, changing it from `vprp->fields` to
`sizeof(vprp->field_info[0])` to prevent reading beyond the
allocated buffer.
CVE: CVE-2026-73434
Upstream patches:
- 0bcc6564c7.patch
Resolves: RHEL-239048
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport CVE-2026-18649 fix from upstream GStreamer MR 12244
to gstreamer1-plugins-good 1.16.1. The patch adds a
max-fragmentation-unit-size property (default 32 MB) to both
H.264 and H.265 RTP depayloaders. If a fragmentation unit
exceeds this limit while being assembled, it is dropped and
the depayloader state is reset, preventing excessive memory
usage from crafted RTP streams.
CVE: CVE-2026-18649
Upstream patches:
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12244.patch
Resolves: RHEL-224145
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream GStreamer MR !12231 to fix CVE-2026-73433,
addressing multiple security issues in the AVI demuxer
(gst/avi/gstavidemux.c). The patch includes fixes for
bounds checking on FUJIFILM strd parsing, read-only buffer
handling, tag pointer dereferencing, vprp field info
calculation, integer overflow in index parsing, and subindex
item count validation.
CVE: CVE-2026-73433
Upstream patches:
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231.patch
Resolves: RHEL-239068
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport 4 upstream patches from GStreamer MR !11811 to fix
CVE-2026-53705 (integer overflow vulnerabilities in wavpackdec).
The patches address:
- Integer overflow in output buffer size allocation
- Use of correctly-sized variable types
- Integer overflow in input buffer size check
- Unmapping input buffer directly after decoding
Paths were adjusted from upstream monorepo layout to match the
RHEL 8 standalone source tree, and conflicts were resolved for
3 of the 4 patches due to differences in the 1.16.1 codebase.
CVE: CVE-2026-53705
Upstream patches:
- ed09b69275.patch
- e9ded43316.patch
- 9326c636a2.patch
- f7cb3e0288.patch
Resolves: RHEL-184473
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
