RHSA-2026:99129HighCVSS 7.5

Red Hat Security Advisory: gstreamer1 security update

Published
November 11, 2026
Last Modified
November 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-125704 →

📋 Description

CVE-2026-125704 — gstreamer: gstreamer: Use-after-free in GStreamer core buffer value deserialization

🎯 Affected products18

  • Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-0:1.26.7-5.el10_3.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-0:1.26.7-5.el10_3.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-0:1.26.7-5.el10_3.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-0:1.26.7-5.el10_3.1.src as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-0:1.26.7-5.el10_3.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-debuginfo-0:1.26.7-5.el10_3.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-debuginfo-0:1.26.7-5.el10_3.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-debuginfo-0:1.26.7-5.el10_3.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-debuginfo-0:1.26.7-5.el10_3.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-debugsource-0:1.26.7-5.el10_3.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-debugsource-0:1.26.7-5.el10_3.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-debugsource-0:1.26.7-5.el10_3.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-debugsource-0:1.26.7-5.el10_3.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-devel-0:1.26.7-5.el10_3.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-devel-0:1.26.7-5.el10_3.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-devel-0:1.26.7-5.el10_3.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-devel-0:1.26.7-5.el10_3.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: There is no complete mitigation for applications that continue to deserialize untrusted GStreamer caps or structure strings. Restrict access to network-facing GStreamer Data Protocol receivers to trusted peers, and avoid passing externally supplied strings to gst_caps_from_string() or gst_structure_from_string() until an update is available. These measures reduce exposure only where the application can control those input paths.

🔗 References (4)