Backport upstream fix for CVE-2026-18296, a heap buffer overflow
in the MOV/MP4 moov recovery tool (qtmoovrecover). The patch adds
box size validations and version checks to atomsrecovery.c to
prevent out-of-bounds memory access when processing malformed
input files.
CVE: CVE-2026-18296
Upstream patches:
- 93fa4cd30b.patch
Resolves: RHEL-246573
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream commit 0bcc6564c7 to fix CVE-2026-73434
in the AVI demuxer. The patch corrects the divisor used in
gst_avi_demux_riff_parse_vprp() when calculating the available
number of vprp field infos, changing it from an incorrect
division by vprp->fields to the correct sizeof(vprp->field_info[0]).
CVE: CVE-2026-73434
Upstream patches:
- 0bcc6564c7.patch
Resolves: RHEL-239039
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream commit bb8fb5a9bf15fb845863430281e4bf908aec7090
to fix CVE-2026-73433. The patch adds bounds checks in
gst_avi_demux_parse_strd() to prevent buffer underflows when
parsing FUJIFILM metadata in AVI files, ensuring sufficient
data is available before memory access and correcting loop
condition ordering.
CVE: CVE-2026-73433
Upstream patches:
- bb8fb5a9bf.patch
Resolves: RHEL-239066
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream MR 12234 to fix CVE-2026-18649 in
gstreamer1-plugins-good-1.22.12. Adds a max-fragmentation-unit-size
property (default 32MB) to both the H264 and H265 RTP depayloaders,
dropping fragmentation units that exceed this limit to prevent
excessive memory usage. Also properly resets internal state fields
when discarding data during fragmentation unit handling.
CVE: CVE-2026-18649
Upstream patches:
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12234.patch
Resolves: RHEL-224165
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport CVE-2026-53705 fix from upstream GStreamer MR !11797
(4 commits by Sebastian Dröge) to address integer overflow
vulnerabilities in the wavpackdec element. The patch fixes
integer overflows when calculating output buffer size and
checking input buffer size, uses correctly-sized variable
types, and unmaps the input buffer directly after decoding
to avoid use-after-free scenarios.
CVE: CVE-2026-53705
Upstream patches:
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11797.patch
Resolves: RHEL-184478
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
