RLSA-2026:99126: Important: gstreamer1-plugins-base security update

Q: What does an attacker need to exploit this issue?

The provided CVSS vector indicates that exploitation is network-based, has low attack complexity, and requires neither privileges nor user interaction.

Q: What is the indicated security impact?

The advisory rates the issue high at 7.5. The CVSS vector indicates no confidentiality or integrity impact, but a high availability impact.

Q: Which Rocky Linux package variants are covered by this update?

The advisory lists gstreamer1-plugins-base and its debuginfo, debugsource, devel, tools, and tools-debuginfo package variants.

Published Nov 13, 2026

Updated

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.

Security Fix(es):

gst-plugins-base: gst-plugins-base: Missing bounds checks in RTCP SDES packet parsing (CVE-2026-125712)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

6 affected componentsFixes available

rocky-linux/gstreamer1-plugins-base<0:1.22.12-10.el9_9.1

0:1.22.12-10.el9_9.1

rocky-linux/gstreamer1-plugins-base-debuginfo<0:1.22.12-10.el9_9.1

0:1.22.12-10.el9_9.1

rocky-linux/gstreamer1-plugins-base-debugsource<0:1.22.12-10.el9_9.1

0:1.22.12-10.el9_9.1

rocky-linux/gstreamer1-plugins-base-devel<0:1.22.12-10.el9_9.1

0:1.22.12-10.el9_9.1

rocky-linux/gstreamer1-plugins-base-tools<0:1.22.12-10.el9_9.1

0:1.22.12-10.el9_9.1

rocky-linux/gstreamer1-plugins-base-tools-debuginfo<0:1.22.12-10.el9_9.1

0:1.22.12-10.el9_9.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rocky-linux/gstreamer1-plugins-base to a version that resolves this vulnerability.
Fixed in 0:1.22.12-10.el9_9.1
Upgrade
Upgrade rocky-linux/gstreamer1-plugins-base-debuginfo to a version that resolves this vulnerability.
Fixed in 0:1.22.12-10.el9_9.1
Upgrade
Upgrade rocky-linux/gstreamer1-plugins-base-debugsource to a version that resolves this vulnerability.
Fixed in 0:1.22.12-10.el9_9.1
Upgrade
Upgrade rocky-linux/gstreamer1-plugins-base-devel to a version that resolves this vulnerability.
Fixed in 0:1.22.12-10.el9_9.1
Upgrade
Upgrade rocky-linux/gstreamer1-plugins-base-tools to a version that resolves this vulnerability.
Fixed in 0:1.22.12-10.el9_9.1
Upgrade
Upgrade rocky-linux/gstreamer1-plugins-base-tools-debuginfo to a version that resolves this vulnerability.
Fixed in 0:1.22.12-10.el9_9.1

Event History

Nov 13, 2026

Advisory Published

via OSV·12:04 PM

Data Sourced

via OSV·12:04 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-125712

Frequently Asked Questions

What does an attacker need to exploit this issue?

The provided CVSS vector indicates that exploitation is network-based, has low attack complexity, and requires neither privileges nor user interaction.

What is the indicated security impact?

The advisory rates the issue high at 7.5. The CVSS vector indicates no confidentiality or integrity impact, but a high availability impact.

Which Rocky Linux package variants are covered by this update?

The advisory lists gstreamer1-plugins-base and its debuginfo, debugsource, devel, tools, and tools-debuginfo package variants.

RLSA-2026:99126: Important: gstreamer1-plugins-base security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the indicated security impact?

Which Rocky Linux package variants are covered by this update?

Company

Resources

Contact