gstreamer1-plugins-good security update
GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins. Security Fix(es): GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of MRF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29510.(CVE-2026-18295) GStreamer MRF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of MRF files. The issue results from the lack of proper validation of the len
OESA-2026-4054
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:OESA-2026-4054
gstreamer1-plugins-good
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.20.3-10.oe2403sp4
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.20.3-10.oe2403sp4"
}
]
}
],
"package": {
"name": "gstreamer1-plugins-good",
"purl": "pkg:rpm/openEuler/gstreamer1-plugins-good&distro=openEuler-24.03-LTS-SP4",
"ecosystem": "openEuler:24.03-LTS-SP4"
},
"database_specific": {
"source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4054.json"
},
"ecosystem_specific": {
"src": [
"gstreamer1-plugins-good-1.20.3-10.oe2403sp4.src.rpm"
],
"x86_64": [
"gstreamer1-plugins-good-1.20.3-10.oe2403sp4.x86_64.rpm",
"gstreamer1-plugins-good-debuginfo-1.20.3-10.oe2403sp4.x86_64.rpm",
"gstreamer1-plugins-good-debugsource-1.20.3-10.oe2403sp4.x86_64.rpm",
"gstreamer1-plugins-good-extras-1.20.3-10.oe2403sp4.x86_64.rpm",
"gstreamer1-plugins-good-gtk-1.20.3-10.oe2403sp4.x86_64.rpm",
"gstreamer1-plugins-good-qt-1.20.3-10.oe2403sp4.x86_64.rpm"
],
"aarch64": [
"gstreamer1-plugins-good-1.20.3-10.oe2403sp4.aarch64.rpm",
"gstreamer1-plugins-good-debuginfo-1.20.3-10.oe2403sp4.aarch64.rpm",
"gstreamer1-plugins-good-debugsource-1.20.3-10.oe2403sp4.aarch64.rpm",
"gstreamer1-plugins-good-extras-1.20.3-10.oe2403sp4.aarch64.rpm",
"gstreamer1-plugins-good-gtk-1.20.3-10.oe2403sp4.aarch64.rpm",
"gstreamer1-plugins-good-qt-1.20.3-10.oe2403sp4.aarch64.rpm"
]
}
}
]Publisher severity
high
Source reference: /database_specific/severity
- Event
- #14655 · Revision 1
- Added to Heist Feed
- Publisher date