RLSA-2026:99012: Important: gstreamer1-plugins-base security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.
Security Fix(es):
gst-plugins-base: gst-plugins-base: Missing bounds checks in RTCP SDES packet parsing (CVE-2026-125712)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/gstreamer1-plugins-baseto a version that resolves this vulnerability.Fixed in 0:1.16.1-8.el8_10 - Upgrade
Upgrade
rocky-linux/gstreamer1-plugins-base-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.16.1-8.el8_10 - Upgrade
Upgrade
rocky-linux/gstreamer1-plugins-base-debugsourceto a version that resolves this vulnerability.Fixed in 0:1.16.1-8.el8_10 - Upgrade
Upgrade
rocky-linux/gstreamer1-plugins-base-develto a version that resolves this vulnerability.Fixed in 0:1.16.1-8.el8_10
Event History
Frequently Asked Questions
What input would an attacker need to exploit this issue?
The issue is in RTCP SDES packet parsing, so exploitation requires maliciously crafted RTCP SDES packet data to reach the affected GStreamer plug-in parser. The advisory rates the flaw as network-accessible with low attack complexity and no required privileges or user interaction.
What is the likely security impact?
The CVSS vector indicates an availability impact only, with no stated confidentiality or integrity impact. Successful exploitation may cause a denial of service.
Which Rocky Linux packages are covered by this update?
The update covers gstreamer1-plugins-base and its debuginfo, debugsource, and development packages.