Red Hat Product Errata RHSA-2026:47069 - Security Advisory Issued: 2026-07-28 Updated: 2026-07-28 RHSA-2026:47069 - Security Advisory Overview Updated Packages Synopsis Important: gstreamer1-plugins-bad-free security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for gstreamer1-plugins-bad-free is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion (CVE-2026-52718) gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720) gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux Server - AUS 9.2 x86_64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.2 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.2 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.2 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.2 s390x Fixes BZ - 2486328 - CVE-2026-52718 gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion BZ - 2486731 - CVE-2026-52720 gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb BZ - 2486733 - CVE-2026-52722 gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling CVEs CVE-2026-52718 CVE-2026-52720 CVE-2026-52722 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux Server - AUS 9.2 SRPM gstreamer1-plugins-bad-free-1.18.4-9.el9_2.3.src.rpm SHA-256: e58a9b869aea2f89432c7fbe28a5bace4aaa23dd6e89198725a30840c4a09007 x86_64 gstreamer1-plugins-bad-free-1.18.4-9.el9_2.3.i686.rpm SHA-256: e83f67db7c2aa2a1664bcbb22b90f50c6dc82f7b5277efc6bb3420ba88935e4e gstreamer1-plugins-bad-free-1.18.4-9.el9_2.3.x86_64.rpm SHA-256: acf396d8ab40e4ee839f4398dc32b4231e7ccc28bab935d770840fb2d28a0f97 gstreamer1-plugins-bad-free-debuginfo-1.18.4-9.el9_2.3.i686.rpm SHA-256: cc80a6de28b51e8e14966ca6d6f267879252e0c71573c31dc52a1ba23b8edbab gstreamer1-plugins-bad-free-debuginfo-1.18.4-9.el9_2.3.x86_64.rpm SHA-256: 6b38363677437a81ba0424b21415510dcc9f629074a8b670d91ef36e1b4e366f gstreamer1-plugins-bad-free-debugsource-1.18.4-9.el9_2.3.i686.rpm SHA-256: 737c3658f10d984364bf62c939cbd38a2eadb0b4e12ba2c5c4c17e7bc3f8da9d gstreamer1-plugins-bad-free-debugsource-1.18.4-9.el9_2.3.x86_64.rpm SHA-256: 85ca9dbb450c95e7c05423c0e3c25170781f0474f24206d0531a96bac2aaa449 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 SRPM gstreamer1-plugins-bad-free-1.18.4-9.el9_2.3.src.rpm SHA-256: e58a9b869aea2f89432c7fbe28a5bace4aaa23dd6e89198725a30840c4a09007 ppc64le gstreamer1-plugins-bad-free-1.18.4-9.el9_2.3.ppc64le.rpm SHA-256: b5f28c46e095e5d91386363ad7bf759ff65f751a97ed10fd6e1764ca2b7d4376 gstreamer1-plugins-bad-free-debuginfo-1.18.4-9.el9_2.3.ppc64le.rpm SHA-256: 8b59dfe4976e9c9ab512f892710dcea1fe4ba249301780d5cf7b5c4d05bf4f43 gstreamer1-plugins-bad-free-debugsource-1.18.4-9.el9_2.3.ppc64le.rpm SHA-256: 9acf84e30fc3d03df66585ccbcf7e9bcfd61fe8c8a4e94bc4c1ce309d618a9fc Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 SRPM gstreamer1-plugins-bad-free-1.18.4-9.el9_2.3.src.rpm SHA-256: e58a9b869aea2f89432c7fbe28a5bace4aaa23dd6e89198725a30840c4a09007 x86_64 gstreamer1-plugins-bad-free-1.18.4-9.el9_2.3.i686.rpm SHA-256: e83f67db7c2aa2a1664bcbb22b90f50c6dc82f7b5277efc6bb3420ba88935e4e gstreamer1-plugins-bad-free-1.18.4-9.el9_2.3.x86_64.rpm SHA-256: acf396d8ab40e4ee839f4398dc32b4231e7ccc28bab935d770840fb2d28a0f97 gstreamer1-plugins-bad-free-debuginfo-1.18.4-9.el9_2.3.i686.rpm SHA-256: cc80a6de28b51e8e14966ca6d6f267879252e0c71573c31dc52a1ba23b8edbab gstreamer1-plugins-bad-free-debuginfo-1.18.4-9.el9_2.3.x86_64.rpm SHA-256: 6b38363677437a81ba0424b21415510dcc9f629074a8b670d91ef36e1b4e366f gstreamer1-plugins-bad-free-debugsource-1.18.4-9.el9_2.3.i686.rpm SHA-256: 737c3658f10d984364bf62c939cbd38a2eadb0b4e12ba2c5c4c17e7bc3f8da9d gstreamer1-plugins-bad-free-debugsource-1.18.4-9.el9_2.3.x86_64.rpm SHA-256: 85ca9dbb450c95e7c05423c0e3c25170781f0474f24206d0531a96bac2aaa449 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2 SRPM gstreamer1-plugins-bad-free-1.18.4-9.el9_2.3.src.rpm SHA-256: e58a9b869aea2f89432c7fbe28a5bace4aaa23dd6e89198725a30840c4a09007 aarch64 gstreamer1-plugins-bad-free-1.18.4-9.el9_2.3.aarch64.rpm SHA-256: 794a1bb3af14b2938512adce4dd8a46606513e4b693167dcdbc80591715ef785 gstreamer1-plugins-bad-free-debuginfo-1.18.4-9.el9_2.3.aarch64.rpm SHA-256: 1acd808538fcf2f359e126e4d2d003146ace38783ec12fcada4a8cffc59f37a2 gstreamer1-plugins-bad-free-debugsource-1.18.4-9.el9_2.3.aarch64.rpm SHA-256: 83861bc90496a028ed8666d5ac76110ea4b51407c469e5bc80a5a6000890a4ec Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2 SRPM gstreamer1-plugins-bad-free-1.18.4-9.el9_2.3.src.rpm SHA-256: e58a9b869aea2f89432c7fbe28a5bace4aaa23dd6e89198725a30840c4a09007 s390x gstreamer1-plugins-bad-free-1.18.4-9.el9_2.3.s390x.rpm SHA-256: 30d0be0dab0611c657cfd520a3ccac228513834a68e3eb83572c72367426b4ac gstreamer1-plugins-bad-free-debuginfo-1.18.4-9.el9_2.3.s390x.rpm SHA-256: d5435c050608072831e4ad3418f75b58d62800b8dfe0e2292eb009e440729f6f gstreamer1-plugins-bad-free-debugsource-1.18.4-9.el9_2.3.s390x.rpm SHA-256: c6bb544694864d497796d623c86da0497498efa15081d11e6d0629aa35530ab2 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.2 SRPM gstreamer1-plugins-bad-free-1.18.4-9.el9_2.3.src.rpm SHA-256: e58a9b869aea2f89432c7fbe28a5bace4aaa23dd6e89198725a30840c4a09007 x86_64 gstreamer1-plugins-bad-free-1.18.4-9.el9_2.3.i686.rpm SHA-256: e83f67db7c2aa2a1664bcbb22b90f50c6dc82f7b5277efc6bb3420ba88935e4e gstreamer1-plugins-bad-free-1.18.4-9.el9_2.3.x86_64.rpm SHA-256: acf396d8ab40e4ee839f4398dc32b4231e7ccc28bab935d770840fb2d28a0f97 gstreamer1-plugins-bad-free-debuginfo-1.18.4-9.el9_2.3.i686.rpm SHA-256: cc80a6de28b51e8e14966ca6d6f267879252e0c71573c31dc52a1ba23b8edbab gstreamer1-plugins-bad-free-debuginfo-1.18.4-9.el9_2.3.x86_64.rpm SHA-256: 6b38363677437a81ba0424b21415510dcc9f629074a8b670d91ef36e1b4e366f gstreamer1-plugins-bad-free-debugsource-1.18.4-9.el9_2.3.i686.rpm SHA-256: 737c3658f10d984364bf62c939cbd38a2eadb0b4e12ba2c5c4c17e7bc3f8da9d gstreamer1-plugins-bad-free-debugsource-1.18.4-9.el9_2.3.x86_64.rpm SHA-256: 85ca9dbb450c95e7c05423c0e3c25170781f0474f24206d0531a96bac2aaa449 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.2 SRPM gstreamer1-plugins-bad-free-1.18.4-9.el9_2.3.src.rpm SHA-256: e58a9b869aea2f89432c7fbe28a5bace4aaa23dd6e89198725a30840c4a09007 aarch64 gstreamer1-plugins-bad-free-1.18.4-9.el9_2.3.aarch64.rpm SHA-256: 794a1bb3af14b2938512adce4dd8a46606513e4b693167dcdbc80591715ef785 gstreamer1-plugins-bad-free-debuginfo-1.18.4-9.el9_2.3.aarch64.rpm SHA-256: 1acd808538fcf2f359e126e4d2d003146ace38783ec12fcada4a8cffc59f37a2 gstreamer1-plugins-bad-free-debugsource-1.18.4-9.el9_2.3.aarch64.rpm SHA-256: 83861bc90496a028ed8666d5ac76110ea4b51407c469e5bc80a5a6000890a4ec Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.2 SRPM gstreamer1-plugins-bad-free-1.18.4-9.el9_2.3.src.rpm SHA-256: e58a9b869aea2f89432c7fbe28a5bace4aaa23dd6e89198725a30840c4a09007 ppc64le gstreamer1-plugins-bad-free-1.18.4-9.el9_2.3.ppc64le.rpm SHA-256: b5f28c46e095e5d91386363ad7bf759ff65f751a97ed10fd6e1764ca2b7d4376 gstreamer1-plugins-bad-free-debuginfo-1.18.4-9.el9_2.3.ppc64le.rpm SHA-256: 8b59dfe4976e9c9ab512f892710dcea1fe4ba249301780d5cf7b5c4d05bf4f43 gstreamer1-plugins-bad-free-debugsource-1.18.4-9.el9_2.3.ppc64le.rpm SHA-256: 9acf84e30fc3d03df66585ccbcf7e9bcfd61fe8c8a4e94bc4c1ce309d618a9fc Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.2 SRPM gstreamer1-plugins-bad-free-1.18.4-9.el9_2.3.src.rpm SHA-256: e58a9b869aea2f89432c7fbe28a5bace4aaa23dd6e89198725a30840c4a09007 s390x gstreamer1-plugins-bad-free-1.18.4-9.el9_2.3.s390x.rpm SHA-256: 30d0be0dab0611c657cfd520a3ccac228513834a68e3eb83572c72367426b4ac gstreamer1-plugins-bad-free-debuginfo-1.18.4-9.el9_2.3.s390x.rpm SHA-256: d5435c050608072831e4ad3418f75b58d62800b8dfe0e2292eb009e440729f6f gstreamer1-plugins-bad-free-debugsource-1.18.4-9.el9_2.3.s390x.rpm SHA-256: c6bb544694864d497796d623c86da0497498efa15081d11e6d0629aa35530ab2 The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .