Red Hat Product Errata RHSA-2026:47076 - Security Advisory Issued: 2026-07-28 Updated: 2026-07-28 RHSA-2026:47076 - Security Advisory Overview Updated Packages Synopsis Important: gstreamer1-plugins-bad-free security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for gstreamer1-plugins-bad-free is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720) gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.4 x86_64 Red Hat Enterprise Linux Server - AUS 8.4 x86_64 Fixes BZ - 2486731 - CVE-2026-52720 gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb BZ - 2486733 - CVE-2026-52722 gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling CVEs CVE-2026-52720 CVE-2026-52722 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.4 SRPM gstreamer1-plugins-bad-free-1.16.1-4.el8_4.2.src.rpm SHA-256: 0db75671913a3670fbe623dc5bcd7c583bf4458364ba56cf762bb2a4f7903a47 x86_64 gstreamer1-plugins-bad-free-1.16.1-4.el8_4.2.i686.rpm SHA-256: 5cb570feb3de35235bc2e406a436b5a1e2a03bacc3a637fa32e5fa5a96f3175f gstreamer1-plugins-bad-free-1.16.1-4.el8_4.2.x86_64.rpm SHA-256: 326b22c79b64a64312e0366cabe0cd426f95be3547e5b15906d824e381eddb45 gstreamer1-plugins-bad-free-debuginfo-1.16.1-4.el8_4.2.i686.rpm SHA-256: 9b56e927ca12ed6d6fab4e1eebe3fa537407f9197d789fc295d6b33cd2a82510 gstreamer1-plugins-bad-free-debuginfo-1.16.1-4.el8_4.2.x86_64.rpm SHA-256: 11834fdd040d59c736fd5a9bf5d8e2d10bcc49804b28bde4c85526330dd90d5f gstreamer1-plugins-bad-free-debugsource-1.16.1-4.el8_4.2.i686.rpm SHA-256: 7922f3df47d948baf243c22e32ee39140ef74935508ce80756a560d6ebd26995 gstreamer1-plugins-bad-free-debugsource-1.16.1-4.el8_4.2.x86_64.rpm SHA-256: 9c78b9f2c0711f846883004474213e748df91d18d62c51a7e725912941a77581 Red Hat Enterprise Linux Server - AUS 8.4 SRPM gstreamer1-plugins-bad-free-1.16.1-4.el8_4.2.src.rpm SHA-256: 0db75671913a3670fbe623dc5bcd7c583bf4458364ba56cf762bb2a4f7903a47 x86_64 gstreamer1-plugins-bad-free-1.16.1-4.el8_4.2.i686.rpm SHA-256: 5cb570feb3de35235bc2e406a436b5a1e2a03bacc3a637fa32e5fa5a96f3175f gstreamer1-plugins-bad-free-1.16.1-4.el8_4.2.x86_64.rpm SHA-256: 326b22c79b64a64312e0366cabe0cd426f95be3547e5b15906d824e381eddb45 gstreamer1-plugins-bad-free-debuginfo-1.16.1-4.el8_4.2.i686.rpm SHA-256: 9b56e927ca12ed6d6fab4e1eebe3fa537407f9197d789fc295d6b33cd2a82510 gstreamer1-plugins-bad-free-debuginfo-1.16.1-4.el8_4.2.x86_64.rpm SHA-256: 11834fdd040d59c736fd5a9bf5d8e2d10bcc49804b28bde4c85526330dd90d5f gstreamer1-plugins-bad-free-debugsource-1.16.1-4.el8_4.2.i686.rpm SHA-256: 7922f3df47d948baf243c22e32ee39140ef74935508ce80756a560d6ebd26995 gstreamer1-plugins-bad-free-debugsource-1.16.1-4.el8_4.2.x86_64.rpm SHA-256: 9c78b9f2c0711f846883004474213e748df91d18d62c51a7e725912941a77581 The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .