Backport upstream MR 12042 to fix CVE-2026-18299 in the
rtpsbcdepay element. The patch includes three commits that
fix a use-after-free by resetting buffer pointers after
ownership transfer, add a payload length bounds check for
the payload header, and correct variable shadowing
introduced by the first fix.
CVE: CVE-2026-18299
Upstream patches:
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12042.patch
Resolves: RHEL-246615
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream fix for CVE-2026-18298 from GitLab MR 12043.
The patch includes two commits by Sebastian Dröge:
- Drop gdkpixbufdec rank to NONE to prevent auto-selection
for untrusted inputs.
- Handle format and resolution changes correctly by checking
on every frame, not just the first one.
CVE: CVE-2026-18298
Upstream patches:
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12043.patch
Resolves: RHEL-246555
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream commit 93fa4cd3 to fix CVE-2026-18296 in
gstreamer1-plugins-good. The patch adds box size and version
validation to atomsrecovery.c (qtmoovrecover), preventing
potential issues with malformed input files.
CVE: CVE-2026-18296
Upstream patches:
- 93fa4cd30b.patch
Resolves: RHEL-246547
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream commit bb8fb5a9bf15 to fix a buffer underflow
vulnerability in the AVI demuxer's FUJIFILM strd parser
(CVE-2026-73433). The patch adds proper bounds checking before
memory accesses in gstavidemux.c, ensuring enough data is
available when parsing FUJIFILM metadata tags to prevent
out-of-bounds reads.
CVE: CVE-2026-73433
Upstream patches:
- bb8fb5a9bf.patch
Resolves: RHEL-239061
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream commit 0bcc6564c7d to fix CVE-2026-73434,
an out-of-bounds read in avidemux. The patch corrects the
divisor used when calculating the available number of vprp
field info entries, changing it from `vprp->fields` to
`sizeof(vprp->field_info[0])`.
CVE: CVE-2026-73434
Upstream patches:
- 0bcc6564c7.patch
Resolves: RHEL-239041
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream fix (commit f9567e3e26c9, MR !11242) for
CVE-2026-5056 (ZDI-CAN-29392). The patch adds integer overflow
and bounds checks to uncompressed video (uncv) handling in
qtdemux.c, including upper bounds on cmpd and uncC component
counts, validation of num_components range, component_index
bounds checking, and a guard against GST_VIDEO_FORMAT_UNKNOWN
before using the format.
CVE: CVE-2026-5056
Upstream patches:
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11242.patch
Resolves: RHEL-222332
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream MR 12234 to fix CVE-2026-18649 in
rtph264depay and rtph265depay elements. The patch limits the
maximum fragmentation unit size (defaulting to 32MB) to prevent
excessive memory usage, and properly resets internal state fields
when errors occur during fragmentation unit handling.
CVE: CVE-2026-18649
Upstream patches:
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12234.patch
Resolves: RHEL-224159
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport CVE-2026-53705 fix from upstream GStreamer MR #11797
(4 commits) to address integer overflow vulnerabilities in the
wavpack decoder. The patch uses g_size_checked_mul to avoid
integer overflow when calculating output buffer size, corrects
variable types to prevent overflow, fixes integer overflow in
input buffer size check, and unmaps input buffer earlier to
prevent use-after-free in error paths.
CVE: CVE-2026-53705
Upstream patches:
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11797.patch
Resolves: RHEL-184481
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
The soup elements dynamically load either version of libsoup, and
therefore do not link to either. However, the -devel packages are
still used for the tests.
