RLSA-2026:98621: Important: gstreamer1-plugins-bad-free security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.
Security Fix(es):
gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: stack buffer overflow in H.266/VVC parser (CVE-2026-119777)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/gstreamer1-plugins-bad-free-debugsourceto a version that resolves this vulnerability.Fixed in 0:1.26.7-9.el10_3.1 - Upgrade
Upgrade
rocky-linux/gstreamer1-plugins-bad-free-libsto a version that resolves this vulnerability.Fixed in 0:1.26.7-9.el10_3.1 - Upgrade
Upgrade
rocky-linux/gstreamer1-plugins-bad-free-libs-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.26.7-9.el10_3.1 - Upgrade
Upgrade
rocky-linux/gstreamer1-plugins-bad-free-develto a version that resolves this vulnerability.Fixed in 0:1.26.7-9.el10_3.1 - Upgrade
Upgrade
rocky-linux/gstreamer1-plugins-bad-freeto a version that resolves this vulnerability.Fixed in 0:1.26.7-9.el10_3.1 - Upgrade
Upgrade
rocky-linux/gstreamer1-plugins-bad-free-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.26.7-9.el10_3.1
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The CVSS vector indicates the issue is reachable over a network, requires no attacker privileges, and requires user interaction. The advisory does not specify the exact user action or media input needed to trigger the overflow.
Which Rocky Linux packages are in scope?
The advisory lists gstreamer1-plugins-bad-free and its -libs, -devel, debugsource, and debuginfo variants. Systems without these listed packages are not identified as in scope by this advisory.
Can I determine exposure by comparing installed package versions?
No affected or fixed package versions are provided in the supplied advisory data. You can identify whether the listed packages are installed, but version-based confirmation requires information not included here.