Backport upstream commit cf4f7cbc081cde7769862b424c105f10c083171b
to fix CVE-2026-18298, a heap buffer overflow in the GdkPixbuf
image decoder (gstgdkpixbufdec.c) caused by dimension changes.
The fix moves the n_channels/format determination before the
conditional check and extends the condition to also verify format,
width, and height changes, ensuring the video info is properly
reinitialized when image properties change.
CVE: CVE-2026-18298
Upstream patches:
- cf4f7cbc08.patch
Resolves: RHEL-246561
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream fix for CVE-2026-18299, a Use-After-Free
vulnerability in the RTP SBC depayloader (rtpsbcdepay). The fix
consists of three commits from upstream GStreamer MR !12042:
resetting buffers to NULL after giving away ownership, checking
adapter availability and minimum payload length, and removing
incorrect variable shadowing of `samples`.
CVE: CVE-2026-18299
Upstream patches:
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12042.patch
Resolves: RHEL-246618
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream commit 93fa4cd30ba4 to fix CVE-2026-18296.
The patch adds validation of box sizes and box versions in
atomsrecovery.c (qtmoovrecover), preventing potential security
issues. The upstream monorepo path prefix was stripped to fit
the standalone gst-plugins-good source tree used in RHEL 8.
Added as Patch14 following the existing CVE patch naming
convention.
CVE: CVE-2026-18296
Upstream patches:
- 93fa4cd30b.patch
Resolves: RHEL-246549
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream commit 0bcc6564 to fix an out-of-bounds read
vulnerability in the AVI demuxer (CVE-2026-73434). The fix
corrects the divisor used when calculating the available number
of vprp field infos, changing it from `vprp->fields` to
`sizeof(vprp->field_info[0])` to prevent reading beyond the
allocated buffer.
CVE: CVE-2026-73434
Upstream patches:
- 0bcc6564c7.patch
Resolves: RHEL-239048
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport CVE-2026-18649 fix from upstream GStreamer MR 12244
to gstreamer1-plugins-good 1.16.1. The patch adds a
max-fragmentation-unit-size property (default 32 MB) to both
H.264 and H.265 RTP depayloaders. If a fragmentation unit
exceeds this limit while being assembled, it is dropped and
the depayloader state is reset, preventing excessive memory
usage from crafted RTP streams.
CVE: CVE-2026-18649
Upstream patches:
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12244.patch
Resolves: RHEL-224145
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream GStreamer MR !12231 to fix CVE-2026-73433,
addressing multiple security issues in the AVI demuxer
(gst/avi/gstavidemux.c). The patch includes fixes for
bounds checking on FUJIFILM strd parsing, read-only buffer
handling, tag pointer dereferencing, vprp field info
calculation, integer overflow in index parsing, and subindex
item count validation.
CVE: CVE-2026-73433
Upstream patches:
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231.patch
Resolves: RHEL-239068
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport 4 upstream patches from GStreamer MR !11811 to fix
CVE-2026-53705 (integer overflow vulnerabilities in wavpackdec).
The patches address:
- Integer overflow in output buffer size allocation
- Use of correctly-sized variable types
- Integer overflow in input buffer size check
- Unmapping input buffer directly after decoding
Paths were adjusted from upstream monorepo layout to match the
RHEL 8 standalone source tree, and conflicts were resolved for
3 of the 4 patches due to differences in the 1.16.1 codebase.
CVE: CVE-2026-53705
Upstream patches:
- ed09b69275.patch
- e9ded43316.patch
- 9326c636a2.patch
- f7cb3e0288.patch
Resolves: RHEL-184473
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
