RHSA-2026:98600HighCVSS 8.4

Red Hat Security Advisory: gstreamer1-plugins-base security update

Published
November 11, 2026
Last Modified
November 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-86476 →

📋 Description

CVE-2026-86476 — gstreamer1-plugins-base: gst-plugins-base: heap buffer overflow via unvalidated GstVideoMeta plane extents in gst_video_frame_map_id and video_meta_deserialize

🎯 Affected products26

  • Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-base-0:1.26.7-4.el10_3.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-base-0:1.26.7-4.el10_3.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-base-0:1.26.7-4.el10_3.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-base-0:1.26.7-4.el10_3.1.src as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-base-0:1.26.7-4.el10_3.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-base-debuginfo-0:1.26.7-4.el10_3.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-base-debuginfo-0:1.26.7-4.el10_3.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-base-debuginfo-0:1.26.7-4.el10_3.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-base-debuginfo-0:1.26.7-4.el10_3.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-base-debugsource-0:1.26.7-4.el10_3.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-base-debugsource-0:1.26.7-4.el10_3.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-base-debugsource-0:1.26.7-4.el10_3.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-base-debugsource-0:1.26.7-4.el10_3.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-base-devel-0:1.26.7-4.el10_3.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-base-devel-0:1.26.7-4.el10_3.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-base-devel-0:1.26.7-4.el10_3.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-base-devel-0:1.26.7-4.el10_3.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-base-tools-0:1.26.7-4.el10_3.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-base-tools-0:1.26.7-4.el10_3.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-base-tools-0:1.26.7-4.el10_3.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-base-tools-0:1.26.7-4.el10_3.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-base-tools-debuginfo-0:1.26.7-4.el10_3.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-base-tools-debuginfo-0:1.26.7-4.el10_3.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-base-tools-debuginfo-0:1.26.7-4.el10_3.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-base-tools-debuginfo-0:1.26.7-4.el10_3.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: If inter-process video sharing via unixfd is not required, build or deploy GStreamer without the unixfd plugin (for example meson option -Dgst-plugins-bad:unixfd=disabled, or omit libgstunixfd.so from the GStreamer plugin directory). Upstream confirms this is the only practical mitigation for the cross-process attack path and notes the unixfd plugin is not currently used by Red Hat-packaged or major distribution software. Operational policy to avoid connecting receiver pipelines to Unix socket endpoints controlled by untrusted local processes provides equivalent protection without rebuilding. This does not address the underlying validation gap in libgstvideo when attacker-controlled GstVideoMeta is supplied in-process.

🔗 References (4)