RLSA-2026:99090: Important: gstreamer1 security update
The gstreamer1 packages contain a streaming media framework, based on graphs of filters which operate on media data.
Security Fix(es):
gstreamer: gstreamer: Use-after-free in GStreamer core buffer value deserialization (CVE-2026-125704)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/gstreamer1to a version that resolves this vulnerability.Fixed in 0:1.16.1-3.el8_10 - Upgrade
Upgrade
rocky-linux/gstreamer1-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.16.1-3.el8_10 - Upgrade
Upgrade
rocky-linux/gstreamer1-debugsourceto a version that resolves this vulnerability.Fixed in 0:1.16.1-3.el8_10 - Upgrade
Upgrade
rocky-linux/gstreamer1-develto a version that resolves this vulnerability.Fixed in 0:1.16.1-3.el8_10
Event History
Frequently Asked Questions
Which installed packages are covered by this update?
The advisory covers rocky-linux/gstreamer1 and its debuginfo, debugsource, and devel packages.
What level of access does an attacker need to exploit the issue?
The CVSS vector indicates network-based exploitation with low attack complexity, requiring no privileges and no user interaction.
What is the primary security impact?
The issue is a use-after-free in GStreamer core buffer value deserialization. The supplied CVSS vector indicates a high availability impact, with no listed confidentiality or integrity impact.