RHSA-2026:98600: Important: gstreamer1-plugins-base security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.Security Fix(es): gstreamer1-plugins-base: gst-plugins-base: heap buffer overflow via unvalidated GstVideoMeta plane extents in gstvideoframemapid and videometadeserialize (CVE-2026-86476) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/gstreamer1-plugins-baseto a version that resolves this vulnerability.Fixed in 1.26.7-4.el10_3.1 - Upgrade
Upgrade
redhat/gstreamer1-plugins-base-debuginfoto a version that resolves this vulnerability.Fixed in 1.26.7-4.el10_3.1 - Upgrade
Upgrade
redhat/gstreamer1-plugins-base-debugsourceto a version that resolves this vulnerability.Fixed in 1.26.7-4.el10_3.1 - Upgrade
Upgrade
redhat/gstreamer1-plugins-base-develto a version that resolves this vulnerability.Fixed in 1.26.7-4.el10_3.1 - Upgrade
Upgrade
redhat/gstreamer1-plugins-base-toolsto a version that resolves this vulnerability.Fixed in 1.26.7-4.el10_3.1 - Upgrade
Upgrade
redhat/gstreamer1-plugins-base-tools-debuginfoto a version that resolves this vulnerability.Fixed in 1.26.7-4.el10_3.1 - Upgrade
Upgrade
redhat/gstreamer1-plugins-baseto a version that resolves this vulnerability.Fixed in 1.26.7-4.el10_3.1.aa - Upgrade
Upgrade
redhat/gstreamer1-plugins-base-debuginfoto a version that resolves this vulnerability.Fixed in 1.26.7-4.el10_3.1.aa - Upgrade
Upgrade
redhat/gstreamer1-plugins-base-debugsourceto a version that resolves this vulnerability.Fixed in 1.26.7-4.el10_3.1.aa - Upgrade
Upgrade
redhat/gstreamer1-plugins-base-develto a version that resolves this vulnerability.Fixed in 1.26.7-4.el10_3.1.aa - Upgrade
Upgrade
redhat/gstreamer1-plugins-base-toolsto a version that resolves this vulnerability.Fixed in 1.26.7-4.el10_3.1.aa - Upgrade
Upgrade
redhat/gstreamer1-plugins-base-tools-debuginfoto a version that resolves this vulnerability.Fixed in 1.26.7-4.el10_3.1.aa
Event History
Frequently Asked Questions
What component contains the vulnerable code?
The issue is in the gst-plugins-base video handling code, specifically gst_video_frame_map_id and video_meta_deserialize. The affected Red Hat package set includes gstreamer1-plugins-base and its tools, development, debug, and debuginfo variants.
What type of flaw is addressed by this update?
The update fixes a heap buffer overflow caused by unvalidated GstVideoMeta plane extents. The issue is identified as CVE-2026-86476 and is classified under CWE-120, Buffer Overflow.