Red Hat Product Errata RHSA-2026:47075 - Security Advisory Issued: 2026-07-28 Updated: 2026-07-28 RHSA-2026:47075 - Security Advisory Overview Updated Packages Synopsis Important: gstreamer1-plugins-bad-free security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for gstreamer1-plugins-bad-free is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720) gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.6 x86_64 Red Hat Enterprise Linux Server - AUS 8.6 x86_64 Fixes BZ - 2486731 - CVE-2026-52720 gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb BZ - 2486733 - CVE-2026-52722 gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling CVEs CVE-2026-52720 CVE-2026-52722 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.6 SRPM gstreamer1-plugins-bad-free-1.16.1-4.el8_6.2.src.rpm SHA-256: f4a7f706aa0a4da3fea7b18335d497555c013399d9983a6ecd64fdfb135fda6b x86_64 gstreamer1-plugins-bad-free-1.16.1-4.el8_6.2.i686.rpm SHA-256: 395e7c387ed6c7b13893e62da8c51cab1ddf89b15d24d3d13a2db895a29094e3 gstreamer1-plugins-bad-free-1.16.1-4.el8_6.2.x86_64.rpm SHA-256: 1f59706b2eb1bd869cb1b8dbc189dd6d67f1b7f27ff99a474355f4ce59fffdcd gstreamer1-plugins-bad-free-debuginfo-1.16.1-4.el8_6.2.i686.rpm SHA-256: a3171955f475926b3a75feb8ca43ae16560ec4abe94194a53142b7357757d6ed gstreamer1-plugins-bad-free-debuginfo-1.16.1-4.el8_6.2.x86_64.rpm SHA-256: 5e9db8de660b2cc2946e027409dd390d58f96d82aca2b1763cc0c26166f962d2 gstreamer1-plugins-bad-free-debugsource-1.16.1-4.el8_6.2.i686.rpm SHA-256: e189108f06bea93551c6bcba9b796a93c4a8e27261b9228e7c6d84b53768ad7e gstreamer1-plugins-bad-free-debugsource-1.16.1-4.el8_6.2.x86_64.rpm SHA-256: fdb04e3646ba93e07213ae9b9fa319c32c12212f52def4b2e704c460f3fc9c09 Red Hat Enterprise Linux Server - AUS 8.6 SRPM gstreamer1-plugins-bad-free-1.16.1-4.el8_6.2.src.rpm SHA-256: f4a7f706aa0a4da3fea7b18335d497555c013399d9983a6ecd64fdfb135fda6b x86_64 gstreamer1-plugins-bad-free-1.16.1-4.el8_6.2.i686.rpm SHA-256: 395e7c387ed6c7b13893e62da8c51cab1ddf89b15d24d3d13a2db895a29094e3 gstreamer1-plugins-bad-free-1.16.1-4.el8_6.2.x86_64.rpm SHA-256: 1f59706b2eb1bd869cb1b8dbc189dd6d67f1b7f27ff99a474355f4ce59fffdcd gstreamer1-plugins-bad-free-debuginfo-1.16.1-4.el8_6.2.i686.rpm SHA-256: a3171955f475926b3a75feb8ca43ae16560ec4abe94194a53142b7357757d6ed gstreamer1-plugins-bad-free-debuginfo-1.16.1-4.el8_6.2.x86_64.rpm SHA-256: 5e9db8de660b2cc2946e027409dd390d58f96d82aca2b1763cc0c26166f962d2 gstreamer1-plugins-bad-free-debugsource-1.16.1-4.el8_6.2.i686.rpm SHA-256: e189108f06bea93551c6bcba9b796a93c4a8e27261b9228e7c6d84b53768ad7e gstreamer1-plugins-bad-free-debugsource-1.16.1-4.el8_6.2.x86_64.rpm SHA-256: fdb04e3646ba93e07213ae9b9fa319c32c12212f52def4b2e704c460f3fc9c09 The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .