RHSA-2026:49517: Important: gstreamer-plugins-bad-free security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer-plugins-bad-free package contains a collection of plug-ins for GStreamer.Security Fix(es): gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720) gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/gstreamer-plugins-bad-freeto a version that resolves this vulnerability.Fixed in 0.10.23-25.el7_9 - Upgrade
Upgrade
redhat/gstreamer-plugins-bad-free-debuginfoto a version that resolves this vulnerability.Fixed in 0.10.23-25.el7_9 - Upgrade
Upgrade
redhat/gstreamer-plugins-bad-free-develto a version that resolves this vulnerability.Fixed in 0.10.23-25.el7_9 - Upgrade
Upgrade
redhat/gstreamer-plugins-bad-free-devel-docsto a version that resolves this vulnerability.Fixed in 0.10.23-25.el7_9 - Upgrade
Upgrade
gstreamer1-plugins-bad-freeto a version that resolves this vulnerability.Patch CVE-2026-52722 - Upgrade
Upgrade
gstreamer1-plugins-bad-freeto a version that resolves this vulnerability.Patch CVE-2026-52720
Event History
Frequently Asked Questions
What is the severity of RHSA-2026:49517?
The severity of RHSA-2026:49517 is categorized as important.
How do I fix RHSA-2026:49517?
To fix RHSA-2026:49517, you need to update the gstreamer-plugins-bad-free packages to the latest version provided by Red Hat.
What vulnerability does RHSA-2026:49517 address?
RHSA-2026:49517 addresses a heap buffer overflow vulnerability that can be exploited via a crafted VNC server rectangle.
Which Red Hat packages are affected by RHSA-2026:49517?
The affected packages by RHSA-2026:49517 include redhat/gstreamer-plugins-bad-free, redhat/gstreamer-plugins-bad-free-debuginfo, and redhat/gstreamer-plugins-bad-free-devel.
When was RHSA-2026:49517 published?
RHSA-2026:49517 was published on August 3, 2026.