RHSA-2026:99012: Important: gstreamer1-plugins-base security update

Q: Which systems should be prioritized for this update?

Prioritize Red Hat Enterprise Linux for ARM 64, IBM z Systems Extended Life Cycle, and ARM 64 Extended Life Cycle systems that have gstreamer1-plugins-base packages installed. The advisory also lists the devel, debuginfo, debugsource, and tools-debuginfo package variants.

Q: What component is affected by the flaw?

The issue is a missing bounds check in RTCP SDES packet parsing in gst-plugins-base. RTCP SDES parsing is the affected code path identified by the advisory.

Q: How can I determine whether this advisory applies to a host?

Check whether the host is one of the listed Red Hat Enterprise Linux platform variants and has gstreamer1-plugins-base or one of the listed related package variants installed. The advisory identifies CVE-2026-125712 as the security fix included in the update.

Published Nov 11, 2026

Updated

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.Security Fix(es): gst-plugins-base: gst-plugins-base: Missing bounds checks in RTCP SDES packet parsing (CVE-2026-125712) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Other sources

Important: gstreamer1-plugins-base security update

— Red Hat

Affected Software

28 affected componentsFixes available

Red Hat Red Hat Enterprise Linux for ARM 64

Red Hat Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle

Red Hat Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle

Red Hat Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle

Red Hat Red Hat Enterprise Linux for x86_64 - Extended Life Cycle

Red Hat Red Hat Enterprise Linux for x86_64

Red Hat Red Hat Enterprise Linux for IBM z Systems

Red Hat Red Hat Enterprise Linux for Power, little endian

redhat/gstreamer1-plugins-base<1.16.1-8.el8_10

1.16.1-8.el8_10

redhat/gstreamer1-plugins-base<1.16.1-8.el8_10

1.16.1-8.el8_10

redhat/gstreamer1-plugins-base-debuginfo<1.16.1-8.el8_10

1.16.1-8.el8_10

redhat/gstreamer1-plugins-base-debuginfo<1.16.1-8.el8_10

1.16.1-8.el8_10

redhat/gstreamer1-plugins-base-debugsource<1.16.1-8.el8_10

1.16.1-8.el8_10

redhat/gstreamer1-plugins-base-debugsource<1.16.1-8.el8_10

1.16.1-8.el8_10

redhat/gstreamer1-plugins-base-devel<1.16.1-8.el8_10

1.16.1-8.el8_10

redhat/gstreamer1-plugins-base-devel<1.16.1-8.el8_10

1.16.1-8.el8_10

redhat/gstreamer1-plugins-base-tools-debuginfo<1.16.1-8.el8_10

1.16.1-8.el8_10

redhat/gstreamer1-plugins-base-tools-debuginfo<1.16.1-8.el8_10

1.16.1-8.el8_10

redhat/gstreamer1-plugins-base<1.16.1-8.el8_10

1.16.1-8.el8_10

redhat/gstreamer1-plugins-base-debuginfo<1.16.1-8.el8_10

1.16.1-8.el8_10

redhat/gstreamer1-plugins-base-debugsource<1.16.1-8.el8_10

1.16.1-8.el8_10

redhat/gstreamer1-plugins-base-devel<1.16.1-8.el8_10

1.16.1-8.el8_10

redhat/gstreamer1-plugins-base-tools-debuginfo<1.16.1-8.el8_10

1.16.1-8.el8_10

redhat/gstreamer1-plugins-base<1.16.1-8.el8_10.aa

1.16.1-8.el8_10.aa

redhat/gstreamer1-plugins-base-debuginfo<1.16.1-8.el8_10.aa

1.16.1-8.el8_10.aa

redhat/gstreamer1-plugins-base-debugsource<1.16.1-8.el8_10.aa

1.16.1-8.el8_10.aa

redhat/gstreamer1-plugins-base-devel<1.16.1-8.el8_10.aa

1.16.1-8.el8_10.aa

redhat/gstreamer1-plugins-base-tools-debuginfo<1.16.1-8.el8_10.aa

1.16.1-8.el8_10.aa

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/gstreamer1-plugins-base to a version that resolves this vulnerability.
Fixed in 1.16.1-8.el8_10
Upgrade
Upgrade redhat/gstreamer1-plugins-base-debuginfo to a version that resolves this vulnerability.
Fixed in 1.16.1-8.el8_10
Upgrade
Upgrade redhat/gstreamer1-plugins-base-debugsource to a version that resolves this vulnerability.
Fixed in 1.16.1-8.el8_10
Upgrade
Upgrade redhat/gstreamer1-plugins-base-devel to a version that resolves this vulnerability.
Fixed in 1.16.1-8.el8_10
Upgrade
Upgrade redhat/gstreamer1-plugins-base-tools-debuginfo to a version that resolves this vulnerability.
Fixed in 1.16.1-8.el8_10
Upgrade
Upgrade redhat/gstreamer1-plugins-base to a version that resolves this vulnerability.
Fixed in 1.16.1-8.el8_10.aa
Upgrade
Upgrade redhat/gstreamer1-plugins-base-debuginfo to a version that resolves this vulnerability.
Fixed in 1.16.1-8.el8_10.aa
Upgrade
Upgrade redhat/gstreamer1-plugins-base-debugsource to a version that resolves this vulnerability.
Fixed in 1.16.1-8.el8_10.aa
Upgrade
Upgrade redhat/gstreamer1-plugins-base-devel to a version that resolves this vulnerability.
Fixed in 1.16.1-8.el8_10.aa
Upgrade
Upgrade redhat/gstreamer1-plugins-base-tools-debuginfo to a version that resolves this vulnerability.
Fixed in 1.16.1-8.el8_10.aa

Event History

Nov 11, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Advisory Published

via Red Hat·03:16 PM

Data Sourced

via Red Hat·03:16 PM

Severity

Frequently Asked Questions

Which systems should be prioritized for this update?

Prioritize Red Hat Enterprise Linux for ARM 64, IBM z Systems Extended Life Cycle, and ARM 64 Extended Life Cycle systems that have gstreamer1-plugins-base packages installed. The advisory also lists the devel, debuginfo, debugsource, and tools-debuginfo package variants.

What component is affected by the flaw?

The issue is a missing bounds check in RTCP SDES packet parsing in gst-plugins-base. RTCP SDES parsing is the affected code path identified by the advisory.

How can I determine whether this advisory applies to a host?

Check whether the host is one of the listed Red Hat Enterprise Linux platform variants and has gstreamer1-plugins-base or one of the listed related package variants installed. The advisory identifies CVE-2026-125712 as the security fix included in the update.

RHSA-2026:99012: Important: gstreamer1-plugins-base security update

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems should be prioritized for this update?

What component is affected by the flaw?

How can I determine whether this advisory applies to a host?

Company

Resources

Contact

Frequently Asked Questions

Which systems should be prioritized for this update?

What component is affected by the flaw?

How can I determine whether this advisory applies to a host?