RLSA-2026:99129: Important: gstreamer1 security update
The gstreamer1 packages contain a streaming media framework, based on graphs of filters which operate on media data.
Security Fix(es):
gstreamer: gstreamer: Use-after-free in GStreamer core buffer value deserialization (CVE-2026-125704)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/gstreamer1-debugsourceto a version that resolves this vulnerability.Fixed in 0:1.26.7-5.el10_3.1 - Upgrade
Upgrade
rocky-linux/gstreamer1to a version that resolves this vulnerability.Fixed in 0:1.26.7-5.el10_3.1 - Upgrade
Upgrade
rocky-linux/gstreamer1-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.26.7-5.el10_3.1 - Upgrade
Upgrade
rocky-linux/gstreamer1-develto a version that resolves this vulnerability.Fixed in 0:1.26.7-5.el10_3.1
Event History
Frequently Asked Questions
Which Rocky Linux packages are covered by this update?
The advisory covers gstreamer1, gstreamer1-debugsource, gstreamer1-debuginfo, and gstreamer1-devel.
What is the potential impact of the issue?
The issue is a use-after-free in GStreamer core buffer value deserialization. It is rated high with a CVSS score of 7.5 and has an availability impact of high; confidentiality and integrity impacts are listed as none.
Does exploitation require authentication or user interaction?
The CVSS vector indicates network attack access, low attack complexity, no privileges required, and no user interaction required.