USN-9038-1: gst-plugins-good1.0, gst-plugins-base1.0 vulnerabilities
It was discovered that GStreamer Good Plugins did not properly handle certain network streams. A remote attacker could possibly use this issue to cause an application crash or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-3083, CVE-2026-3085)
It was discovered that GStreamer Good Plugins incorrectly handled certain Matroska files. An attacker could possibly use this issue to cause an application crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-39043)
It was discovered that GStreamer Good Plugins incorrectly handled certain WAV files. An attacker could possibly use this issue to make GStreamer Good Plugins crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-39044)
It was discovered that GStreamer Good Plugins incorrectly handled certain MP4 audio tracks. An attacker could possibly use this issue to cause an application crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-46470)
It was discovered that GStreamer Good Plugins incorrectly handled certain MP4 files. An attacker could possibly use this issue to make GStreamer Good Plugins crash, resulting in a denial of service, or obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-46471)
It was discovered that GStreamer Good Plugins incorrectly handled certain WavPack audio files. An attacker could possibly use this issue to cause an application crash, resulting in a denial of service, or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-53705)
It was discovered that GStreamer Good Plugins and GStreamer Base Plugins incorrectly handled certain network streams. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-111183)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/gst-plugins-base1.0to a version that resolves this vulnerability.Fixed in 1.8.3-1ubuntu0.3+esm6 - Upgrade
Upgrade
ubuntu/gst-plugins-good1.0to a version that resolves this vulnerability.Fixed in 1.8.3-1ubuntu0.5+esm5 - Upgrade
Upgrade
ubuntu/gst-plugins-base1.0to a version that resolves this vulnerability.Fixed in 1.14.5-0ubuntu1~18.04.3+esm5 - Upgrade
Upgrade
ubuntu/gst-plugins-good1.0to a version that resolves this vulnerability.Fixed in 1.14.5-0ubuntu1~18.04.3+esm5 - Upgrade
Upgrade
ubuntu/gst-plugins-base1.0to a version that resolves this vulnerability.Fixed in 1.16.3-0ubuntu1.4+esm4 - Upgrade
Upgrade
ubuntu/gst-plugins-good1.0to a version that resolves this vulnerability.Fixed in 1.16.3-0ubuntu1.3+esm5 - Upgrade
Upgrade
ubuntu/gst-plugins-base1.0to a version that resolves this vulnerability.Fixed in 1.20.1-1ubuntu0.8 - Upgrade
Upgrade
ubuntu/gst-plugins-good1.0to a version that resolves this vulnerability.Fixed in 1.20.3-0ubuntu1.11 - Upgrade
Upgrade
ubuntu/gst-plugins-base1.0to a version that resolves this vulnerability.Fixed in 1.28.7-1ubuntu0.1 - Upgrade
Upgrade
ubuntu/gst-plugins-good1.0to a version that resolves this vulnerability.Fixed in 1.28.7-1ubuntu0.1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which Ubuntu releases are affected?
The issues described affect Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
What attacker-controlled content can trigger these issues?
The affected components may be exposed through certain network streams, Matroska files, WAV files, and MP4 audio tracks. Applications that process untrusted media or network media streams are the relevant exposure points.
Which issues may allow code execution rather than only denial of service?
CVE-2026-3083 and CVE-2026-3085, involving certain network streams, may allow an attacker to crash an application or execute arbitrary code. The Matroska, WAV, and MP4 audio-track issues described are reported as application crashes resulting in denial of service.