Red Hat Product Errata RHSA-2026:47071 - Security Advisory Issued: 2026-07-28 Updated: 2026-07-28 RHSA-2026:47071 - Security Advisory Overview Updated Packages Synopsis Important: gstreamer1-plugins-bad-free security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for gstreamer1-plugins-bad-free is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion (CVE-2026-52718) gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder (CVE-2026-52719) gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720) gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux Server - AUS 9.4 x86_64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.4 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.4 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.4 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.4 s390x Fixes BZ - 2486328 - CVE-2026-52718 gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion BZ - 2486353 - CVE-2026-52719 gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder BZ - 2486731 - CVE-2026-52720 gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb BZ - 2486733 - CVE-2026-52722 gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling CVEs CVE-2026-52718 CVE-2026-52719 CVE-2026-52720 CVE-2026-52722 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux Server - AUS 9.4 SRPM gstreamer1-plugins-bad-free-1.22.1-6.el9_4.4.src.rpm SHA-256: ea5752eb598ff8a3dfcce570c94afed536116b67d2d0256a83351eb43b4bf25c x86_64 gstreamer1-plugins-bad-free-1.22.1-6.el9_4.4.i686.rpm SHA-256: 0fa6f10b358e8cfa7dd123244c9a1d3403df83042f087bf94f8d2b562c57226a gstreamer1-plugins-bad-free-1.22.1-6.el9_4.4.x86_64.rpm SHA-256: 07d8d457bd711b4f7a936d1f7024a242facb35bf0d28525c9beb593f8e590953 gstreamer1-plugins-bad-free-debuginfo-1.22.1-6.el9_4.4.i686.rpm SHA-256: 1e23fef69160d42c520ef490ca3f14b41c2c54a3e6594789095b50b84ba927a2 gstreamer1-plugins-bad-free-debuginfo-1.22.1-6.el9_4.4.x86_64.rpm SHA-256: f4e67689d48817867e5541dfd6177d8121656ded13f760313ef10ea3f0eea104 gstreamer1-plugins-bad-free-debugsource-1.22.1-6.el9_4.4.i686.rpm SHA-256: c0b1d2d15a35fd6a2f760f4d9d4f5c773e3bbe60155d66fe0068ddc203b743d1 gstreamer1-plugins-bad-free-debugsource-1.22.1-6.el9_4.4.x86_64.rpm SHA-256: c34f4eb61bbd1d3abeab275f4417f8d020ed425ae46a50fa8b39b3255b44ff55 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 SRPM gstreamer1-plugins-bad-free-1.22.1-6.el9_4.4.src.rpm SHA-256: ea5752eb598ff8a3dfcce570c94afed536116b67d2d0256a83351eb43b4bf25c ppc64le gstreamer1-plugins-bad-free-1.22.1-6.el9_4.4.ppc64le.rpm SHA-256: f5edcb4848f950e5920cabacf452fa98aed05828d853b1ed69a8f7044e7cd9ba gstreamer1-plugins-bad-free-debuginfo-1.22.1-6.el9_4.4.ppc64le.rpm SHA-256: 1555a935554ca7d4b29e14b446d5563e167197a47071960f7430210109fd71ae gstreamer1-plugins-bad-free-debugsource-1.22.1-6.el9_4.4.ppc64le.rpm SHA-256: dc4fac5d98b80ac34fc04ac3a28d0f400ef22e3138c2b9c3b898c61b5d1fe62c Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 SRPM gstreamer1-plugins-bad-free-1.22.1-6.el9_4.4.src.rpm SHA-256: ea5752eb598ff8a3dfcce570c94afed536116b67d2d0256a83351eb43b4bf25c x86_64 gstreamer1-plugins-bad-free-1.22.1-6.el9_4.4.i686.rpm SHA-256: 0fa6f10b358e8cfa7dd123244c9a1d3403df83042f087bf94f8d2b562c57226a gstreamer1-plugins-bad-free-1.22.1-6.el9_4.4.x86_64.rpm SHA-256: 07d8d457bd711b4f7a936d1f7024a242facb35bf0d28525c9beb593f8e590953 gstreamer1-plugins-bad-free-debuginfo-1.22.1-6.el9_4.4.i686.rpm SHA-256: 1e23fef69160d42c520ef490ca3f14b41c2c54a3e6594789095b50b84ba927a2 gstreamer1-plugins-bad-free-debuginfo-1.22.1-6.el9_4.4.x86_64.rpm SHA-256: f4e67689d48817867e5541dfd6177d8121656ded13f760313ef10ea3f0eea104 gstreamer1-plugins-bad-free-debugsource-1.22.1-6.el9_4.4.i686.rpm SHA-256: c0b1d2d15a35fd6a2f760f4d9d4f5c773e3bbe60155d66fe0068ddc203b743d1 gstreamer1-plugins-bad-free-debugsource-1.22.1-6.el9_4.4.x86_64.rpm SHA-256: c34f4eb61bbd1d3abeab275f4417f8d020ed425ae46a50fa8b39b3255b44ff55 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 SRPM gstreamer1-plugins-bad-free-1.22.1-6.el9_4.4.src.rpm SHA-256: ea5752eb598ff8a3dfcce570c94afed536116b67d2d0256a83351eb43b4bf25c aarch64 gstreamer1-plugins-bad-free-1.22.1-6.el9_4.4.aarch64.rpm SHA-256: dea42d2b9a4fa745a456882dc6139a6757e870819243a121de6ec6142c12498b gstreamer1-plugins-bad-free-debuginfo-1.22.1-6.el9_4.4.aarch64.rpm SHA-256: a036d32cd15126e2daa09243ef92d91ac98f0a3cbe7d73513dcc2659594a508c gstreamer1-plugins-bad-free-debugsource-1.22.1-6.el9_4.4.aarch64.rpm SHA-256: 76586c758b4d29c4aef2707b648b4c31ac6b3c9fcfbe28316929625474940f99 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 SRPM gstreamer1-plugins-bad-free-1.22.1-6.el9_4.4.src.rpm SHA-256: ea5752eb598ff8a3dfcce570c94afed536116b67d2d0256a83351eb43b4bf25c s390x gstreamer1-plugins-bad-free-1.22.1-6.el9_4.4.s390x.rpm SHA-256: 96654a43b66b2fa63393d4793272df4065d6100a7e741ee990d2f675ce9fb4fd gstreamer1-plugins-bad-free-debuginfo-1.22.1-6.el9_4.4.s390x.rpm SHA-256: 91cdecb3d699a6b47c1921fc05a66522e8cde9e1e414cae6908418fb77942773 gstreamer1-plugins-bad-free-debugsource-1.22.1-6.el9_4.4.s390x.rpm SHA-256: 6399b17749f988496878545127c079592d7668d02362794320d4742fb187099c Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.4 SRPM gstreamer1-plugins-bad-free-1.22.1-6.el9_4.4.src.rpm SHA-256: ea5752eb598ff8a3dfcce570c94afed536116b67d2d0256a83351eb43b4bf25c x86_64 gstreamer1-plugins-bad-free-1.22.1-6.el9_4.4.i686.rpm SHA-256: 0fa6f10b358e8cfa7dd123244c9a1d3403df83042f087bf94f8d2b562c57226a gstreamer1-plugins-bad-free-1.22.1-6.el9_4.4.x86_64.rpm SHA-256: 07d8d457bd711b4f7a936d1f7024a242facb35bf0d28525c9beb593f8e590953 gstreamer1-plugins-bad-free-debuginfo-1.22.1-6.el9_4.4.i686.rpm SHA-256: 1e23fef69160d42c520ef490ca3f14b41c2c54a3e6594789095b50b84ba927a2 gstreamer1-plugins-bad-free-debuginfo-1.22.1-6.el9_4.4.x86_64.rpm SHA-256: f4e67689d48817867e5541dfd6177d8121656ded13f760313ef10ea3f0eea104 gstreamer1-plugins-bad-free-debugsource-1.22.1-6.el9_4.4.i686.rpm SHA-256: c0b1d2d15a35fd6a2f760f4d9d4f5c773e3bbe60155d66fe0068ddc203b743d1 gstreamer1-plugins-bad-free-debugsource-1.22.1-6.el9_4.4.x86_64.rpm SHA-256: c34f4eb61bbd1d3abeab275f4417f8d020ed425ae46a50fa8b39b3255b44ff55 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.4 SRPM gstreamer1-plugins-bad-free-1.22.1-6.el9_4.4.src.rpm SHA-256: ea5752eb598ff8a3dfcce570c94afed536116b67d2d0256a83351eb43b4bf25c aarch64 gstreamer1-plugins-bad-free-1.22.1-6.el9_4.4.aarch64.rpm SHA-256: dea42d2b9a4fa745a456882dc6139a6757e870819243a121de6ec6142c12498b gstreamer1-plugins-bad-free-debuginfo-1.22.1-6.el9_4.4.aarch64.rpm SHA-256: a036d32cd15126e2daa09243ef92d91ac98f0a3cbe7d73513dcc2659594a508c gstreamer1-plugins-bad-free-debugsource-1.22.1-6.el9_4.4.aarch64.rpm SHA-256: 76586c758b4d29c4aef2707b648b4c31ac6b3c9fcfbe28316929625474940f99 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.4 SRPM gstreamer1-plugins-bad-free-1.22.1-6.el9_4.4.src.rpm SHA-256: ea5752eb598ff8a3dfcce570c94afed536116b67d2d0256a83351eb43b4bf25c ppc64le gstreamer1-plugins-bad-free-1.22.1-6.el9_4.4.ppc64le.rpm SHA-256: f5edcb4848f950e5920cabacf452fa98aed05828d853b1ed69a8f7044e7cd9ba gstreamer1-plugins-bad-free-debuginfo-1.22.1-6.el9_4.4.ppc64le.rpm SHA-256: 1555a935554ca7d4b29e14b446d5563e167197a47071960f7430210109fd71ae gstreamer1-plugins-bad-free-debugsource-1.22.1-6.el9_4.4.ppc64le.rpm SHA-256: dc4fac5d98b80ac34fc04ac3a28d0f400ef22e3138c2b9c3b898c61b5d1fe62c Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.4 SRPM gstreamer1-plugins-bad-free-1.22.1-6.el9_4.4.src.rpm SHA-256: ea5752eb598ff8a3dfcce570c94afed536116b67d2d0256a83351eb43b4bf25c s390x gstreamer1-plugins-bad-free-1.22.1-6.el9_4.4.s390x.rpm SHA-256: 96654a43b66b2fa63393d4793272df4065d6100a7e741ee990d2f675ce9fb4fd gstreamer1-plugins-bad-free-debuginfo-1.22.1-6.el9_4.4.s390x.rpm SHA-256: 91cdecb3d699a6b47c1921fc05a66522e8cde9e1e414cae6908418fb77942773 gstreamer1-plugins-bad-free-debugsource-1