ALSA-2026:99012: Important: gstreamer1-plugins-base security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.
Security Fix(es):
gst-plugins-base: gst-plugins-base: Missing bounds checks in RTCP SDES packet parsing (CVE-2026-125712)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
almalinux/gstreamer1-plugins-baseto a version that resolves this vulnerability.Fixed in 1.16.1-8.el8_10 - Upgrade
Upgrade
almalinux/gstreamer1-plugins-base-develto a version that resolves this vulnerability.Fixed in 1.16.1-8.el8_10
Event History
Frequently Asked Questions
Which packages are covered by this update?
The update covers almalinux/gstreamer1-plugins-base and almalinux/gstreamer1-plugins-base-devel.
What component contains the security flaw?
The issue is in RTCP SDES packet parsing in gst-plugins-base, where bounds checks are missing.