Red Hat Product Errata RHSA-2026:47717 - Security Advisory Issued: 2026-07-29 Updated: 2026-07-29 RHSA-2026:47717 - Security Advisory Overview Updated Packages Synopsis Important: gstreamer1-plugins-bad-free security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for gstreamer1-plugins-bad-free is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion (CVE-2026-52718) gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder (CVE-2026-52719) gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720) gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 x86_64 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0 s390x Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.0 ppc64le Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.0 aarch64 Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 10.0 x86_64 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 10.0 ppc64le Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 10.0 s390x Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 10.0 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.0 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.0 s390x Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.0 ppc64le Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.0 x86_64 Fixes BZ - 2486328 - CVE-2026-52718 gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion BZ - 2486353 - CVE-2026-52719 gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder BZ - 2486731 - CVE-2026-52720 gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb BZ - 2486733 - CVE-2026-52722 gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling CVEs CVE-2026-52718 CVE-2026-52719 CVE-2026-52720 CVE-2026-52722 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 SRPM gstreamer1-plugins-bad-free-1.24.11-3.el10_0.4.src.rpm SHA-256: 67d7acbcc0861130581a993ea90cecccfbfbb68879f9a3ef8bbd3f3f5430b9be x86_64 gstreamer1-plugins-bad-free-1.24.11-3.el10_0.4.x86_64.rpm SHA-256: 86ec6f9e5c2bccb4ac96596fbcd28bcdf078278133ae023bf8319615cd523e18 gstreamer1-plugins-bad-free-debuginfo-1.24.11-3.el10_0.4.x86_64.rpm SHA-256: abcc7134ceab8c28151a781e88975c1cf05f9207805b5cb30f2912387283d2c9 gstreamer1-plugins-bad-free-debugsource-1.24.11-3.el10_0.4.x86_64.rpm SHA-256: 264555334dc151c954c44c1a51e65989531bfa078293ce3c6905e6e44e3f0148 gstreamer1-plugins-bad-free-libs-1.24.11-3.el10_0.4.x86_64.rpm SHA-256: af0d0667e9f4ff6d37875857399a57c583afe1b278de9d50de14d3bfc7ccf0cc gstreamer1-plugins-bad-free-libs-debuginfo-1.24.11-3.el10_0.4.x86_64.rpm SHA-256: 27a0b2305ed7fa739b59168c8fedfdc2c36e08bbe6f056202198f3180b2055d0 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0 SRPM gstreamer1-plugins-bad-free-1.24.11-3.el10_0.4.src.rpm SHA-256: 67d7acbcc0861130581a993ea90cecccfbfbb68879f9a3ef8bbd3f3f5430b9be s390x gstreamer1-plugins-bad-free-1.24.11-3.el10_0.4.s390x.rpm SHA-256: b7c247dab15fb36488a57be48a259a251afdf35a3dee782a4c4c44614f56bd3e gstreamer1-plugins-bad-free-debuginfo-1.24.11-3.el10_0.4.s390x.rpm SHA-256: 97877cc48202378cba913e25f6bef125040cf87d2ec68e4678c3d76ccc891f66 gstreamer1-plugins-bad-free-debugsource-1.24.11-3.el10_0.4.s390x.rpm SHA-256: e6859943b921503c01b64000d876301ab71f86ef779e65d78875eae48206a4d0 gstreamer1-plugins-bad-free-libs-1.24.11-3.el10_0.4.s390x.rpm SHA-256: c651179696954be7099844d53a64196a9e11692951835686846f2bfb71585509 gstreamer1-plugins-bad-free-libs-debuginfo-1.24.11-3.el10_0.4.s390x.rpm SHA-256: c6d4ebc6cbf9bd58726fb3bf26ddb6f284391d4cb3c879aa9f0e2da15c629761 Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.0 SRPM gstreamer1-plugins-bad-free-1.24.11-3.el10_0.4.src.rpm SHA-256: 67d7acbcc0861130581a993ea90cecccfbfbb68879f9a3ef8bbd3f3f5430b9be ppc64le gstreamer1-plugins-bad-free-1.24.11-3.el10_0.4.ppc64le.rpm SHA-256: 5c754ed710e33bdad8ad222656e5ffc3b2a7af6729b836ba5a912a0cb25bf6d0 gstreamer1-plugins-bad-free-debuginfo-1.24.11-3.el10_0.4.ppc64le.rpm SHA-256: 480d196e20eca0d65ad169de109e799720c6cfe9d7372c2b4a70730650caddb9 gstreamer1-plugins-bad-free-debugsource-1.24.11-3.el10_0.4.ppc64le.rpm SHA-256: 1a6e5b3f6ec8702ce52537c648a2f129c2563f6044f27d82168c391321552169 gstreamer1-plugins-bad-free-libs-1.24.11-3.el10_0.4.ppc64le.rpm SHA-256: d9f1cdac36699e5adac742e5081fac45da8867667a41137cc80c397ec6d5fd47 gstreamer1-plugins-bad-free-libs-debuginfo-1.24.11-3.el10_0.4.ppc64le.rpm SHA-256: 2534c0a69f501c27d33c15a0e0e72ba5460f9eb0748d73e5895add91a2b217c3 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.0 SRPM gstreamer1-plugins-bad-free-1.24.11-3.el10_0.4.src.rpm SHA-256: 67d7acbcc0861130581a993ea90cecccfbfbb68879f9a3ef8bbd3f3f5430b9be aarch64 gstreamer1-plugins-bad-free-1.24.11-3.el10_0.4.aarch64.rpm SHA-256: 9475a8cf395699f6b50a190898fb148fcbd1974acd37316ae7378209952a30b3 gstreamer1-plugins-bad-free-debuginfo-1.24.11-3.el10_0.4.aarch64.rpm SHA-256: 63cbd4415a183fc055f8193628ba4b8921cc73410251bfa9b78de078949a8804 gstreamer1-plugins-bad-free-debugsource-1.24.11-3.el10_0.4.aarch64.rpm SHA-256: 6d257633407919a793ae5780d0cb81e3a76249c2d3ae0b8e357a25327d2a840d gstreamer1-plugins-bad-free-libs-1.24.11-3.el10_0.4.aarch64.rpm SHA-256: 54cf16da0b7fe078fdf5d3e5d757cbc4b9fadf8d652b98c0e580527ad4de6dd6 gstreamer1-plugins-bad-free-libs-debuginfo-1.24.11-3.el10_0.4.aarch64.rpm SHA-256: b26f239b220a2fb9221fb80f14c4a314692d4c9d4746c62d0d983e30770c4a13 Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 10.0 SRPM x86_64 gstreamer1-plugins-bad-free-debuginfo-1.24.11-3.el10_0.4.x86_64.rpm SHA-256: abcc7134ceab8c28151a781e88975c1cf05f9207805b5cb30f2912387283d2c9 gstreamer1-plugins-bad-free-debugsource-1.24.11-3.el10_0.4.x86_64.rpm SHA-256: 264555334dc151c954c44c1a51e65989531bfa078293ce3c6905e6e44e3f0148 gstreamer1-plugins-bad-free-devel-1.24.11-3.el10_0.4.x86_64.rpm SHA-256: 57689146a1176fa1416ed72b9043b086fd5c75e9f850bda8fc6cbc7e22513d46 gstreamer1-plugins-bad-free-libs-debuginfo-1.24.11-3.el10_0.4.x86_64.rpm SHA-256: 27a0b2305ed7fa739b59168c8fedfdc2c36e08bbe6f056202198f3180b2055d0 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 10.0 SRPM ppc64le gstreamer1-plugins-bad-free-debuginfo-1.24.11-3.el10_0.4.ppc64le.rpm SHA-256: 480d196e20eca0d65ad169de109e799720c6cfe9d7372c2b4a70730650caddb9 gstreamer1-plugins-bad-free-debugsource-1.24.11-3.el10_0.4.ppc64le.rpm SHA-256: 1a6e5b3f6ec8702ce52537c648a2f129c2563f6044f27d82168c391321552169 gstreamer1-plugins-bad-free-devel-1.24.11-3.el10_0.4.ppc64le.rpm SHA-256: f0542a7d9538f8529ec81ea4959c33d9cc2bc8d6a4bcf7b5324306178decfb63 gstreamer1-plugins-bad-free-libs-debuginfo-1.24.11-3.el10_0.4.ppc64le.rpm SHA-256: 2534c0a69f501c27d33c15a0e0e72ba5460f9eb0748d73e5895add91a2b217c3 Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 10.0 SRPM s390x gstreamer1-plugins-bad-free-debuginfo-1.24.11-3.el10_0.4.s390x.rpm SHA-256: 97877cc48202378cba913e25f6bef125040cf87d2ec68e4678c3d76ccc891f66 gstreamer1-plugins-bad-free-debugsource-1.24.11-3.el10_0.4.s390x.rpm SHA-256: e6859943b921503c01b64000d876301ab71f86ef779e65d78875eae48206a4d0 gstreamer1-plugins-bad-free-devel-1.24.11-3.el10_0.4.s390x.rpm SHA-256: f07f310a33d844a631ac80c26bd0d23dad4c9c6ac53682196f4246a89c5701ae gstreamer1-plugins-bad-free-libs-debuginfo-1.24.11-3.el10_0.4.s390x.rpm SHA-256: c6d4ebc6cbf9bd58726fb3bf26ddb6f284391d4cb3c879aa9f0e2da15c629761 Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 10.0 SRPM aarch64 gstreamer1-plugins-bad-free-debuginfo-1.24.11-3.el10_0.4.aarch64.rpm SHA-256: 63cbd4415a183fc055f8193628ba4b8921cc73410251bfa9b78de078949a8804 gstreamer1-plugins-bad-free-debugsource-1.24.11-3.el10_0.4.aarch64.rpm SHA-256: 6d257633407919a793ae5780d0cb81e3a76249c2d3ae0b8e357a25327d2a840d gstreamer1-plugins-bad-free-devel-1.24.11-3.el10_0.4.aarch64.rpm SHA-256: f482c1b664752ea3bf5999aa61a2d7b4ddb1225f6fa617a4c0a1357589dd6621 gstreamer1-plugins-bad-free-libs-debuginfo-1.24.11-3.el10_0.4.aarch64.rpm SHA-256: b26f239b220a2fb9221fb80f14c4a314692d4c9d4746c62d0d983e30770c4a13 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.0 SRPM gstreamer1-