Red Hat Product Errata RHSA-2026:47070 - Security Advisory Issued: 2026-07-28 Updated: 2026-07-28 RHSA-2026:47070 - Security Advisory Overview Updated Packages Synopsis Important: gstreamer1-plugins-bad-free security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for gstreamer1-plugins-bad-free is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion (CVE-2026-52718) gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder (CVE-2026-52719) gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720) gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 x86_64 Red Hat Enterprise Linux Server - AUS 9.6 x86_64 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 s390x Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 ppc64le Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 aarch64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 x86_64 Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.6 x86_64 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.6 ppc64le Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.6 s390x Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.6 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.6 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.6 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.6 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.6 s390x Fixes BZ - 2486328 - CVE-2026-52718 gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion BZ - 2486353 - CVE-2026-52719 gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder BZ - 2486731 - CVE-2026-52720 gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb BZ - 2486733 - CVE-2026-52722 gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling CVEs CVE-2026-52718 CVE-2026-52719 CVE-2026-52720 CVE-2026-52722 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 SRPM gstreamer1-plugins-bad-free-1.22.12-5.el9_6.4.src.rpm SHA-256: f1da001b403b8556b9cb880a84c20a5d74bf0a54d3faf7cac7f036ba96a5e98b x86_64 gstreamer1-plugins-bad-free-1.22.12-5.el9_6.4.i686.rpm SHA-256: 924b7cfded277052115c5ecdbfa8733ed7229e4cbcb5343d4c8beace203a0f6f gstreamer1-plugins-bad-free-1.22.12-5.el9_6.4.x86_64.rpm SHA-256: a814d7adffcf82a60d1145b88a63aea6543b372905fbfcf859698c674a4af078 gstreamer1-plugins-bad-free-debuginfo-1.22.12-5.el9_6.4.i686.rpm SHA-256: e5ff7250ff47c80d5ad20527180afe2190f7b4d386c2eb6bdd4ea82f7b212b61 gstreamer1-plugins-bad-free-debuginfo-1.22.12-5.el9_6.4.x86_64.rpm SHA-256: d37c7ceba05d9083a7f2635d884b982026e1621334be1415c9b86747067f9dd7 gstreamer1-plugins-bad-free-debugsource-1.22.12-5.el9_6.4.i686.rpm SHA-256: d3fda7ecffd2e02fea57a7b93c4893e62f59d438b12971919a47c16ad94bbe49 gstreamer1-plugins-bad-free-debugsource-1.22.12-5.el9_6.4.x86_64.rpm SHA-256: 5f5a03d398d1ac067e600f63bc3436f1fce3d3672498348224dba38e4c9497c7 gstreamer1-plugins-bad-free-libs-1.22.12-5.el9_6.4.i686.rpm SHA-256: b54f234b42592acbf0f519ff5077d99d47983e30a4444fa26fec92f75ba1182a gstreamer1-plugins-bad-free-libs-1.22.12-5.el9_6.4.x86_64.rpm SHA-256: 385f39dfaecfffe4da136b160ac9dc534c0293695ae58c8a2c2515390af5e405 gstreamer1-plugins-bad-free-libs-debuginfo-1.22.12-5.el9_6.4.i686.rpm SHA-256: 37bf794e00d38905436c2accefbbb4b38b4e7c590cf88ab993db02cc142dfab8 gstreamer1-plugins-bad-free-libs-debuginfo-1.22.12-5.el9_6.4.x86_64.rpm SHA-256: 4a99e286961d9e5bb59b92ae63050424b8ba5869f71d6b309115a7ef2f09efff Red Hat Enterprise Linux Server - AUS 9.6 SRPM gstreamer1-plugins-bad-free-1.22.12-5.el9_6.4.src.rpm SHA-256: f1da001b403b8556b9cb880a84c20a5d74bf0a54d3faf7cac7f036ba96a5e98b x86_64 gstreamer1-plugins-bad-free-1.22.12-5.el9_6.4.i686.rpm SHA-256: 924b7cfded277052115c5ecdbfa8733ed7229e4cbcb5343d4c8beace203a0f6f gstreamer1-plugins-bad-free-1.22.12-5.el9_6.4.x86_64.rpm SHA-256: a814d7adffcf82a60d1145b88a63aea6543b372905fbfcf859698c674a4af078 gstreamer1-plugins-bad-free-debuginfo-1.22.12-5.el9_6.4.i686.rpm SHA-256: e5ff7250ff47c80d5ad20527180afe2190f7b4d386c2eb6bdd4ea82f7b212b61 gstreamer1-plugins-bad-free-debuginfo-1.22.12-5.el9_6.4.x86_64.rpm SHA-256: d37c7ceba05d9083a7f2635d884b982026e1621334be1415c9b86747067f9dd7 gstreamer1-plugins-bad-free-debugsource-1.22.12-5.el9_6.4.i686.rpm SHA-256: d3fda7ecffd2e02fea57a7b93c4893e62f59d438b12971919a47c16ad94bbe49 gstreamer1-plugins-bad-free-debugsource-1.22.12-5.el9_6.4.x86_64.rpm SHA-256: 5f5a03d398d1ac067e600f63bc3436f1fce3d3672498348224dba38e4c9497c7 gstreamer1-plugins-bad-free-libs-1.22.12-5.el9_6.4.i686.rpm SHA-256: b54f234b42592acbf0f519ff5077d99d47983e30a4444fa26fec92f75ba1182a gstreamer1-plugins-bad-free-libs-1.22.12-5.el9_6.4.x86_64.rpm SHA-256: 385f39dfaecfffe4da136b160ac9dc534c0293695ae58c8a2c2515390af5e405 gstreamer1-plugins-bad-free-libs-debuginfo-1.22.12-5.el9_6.4.i686.rpm SHA-256: 37bf794e00d38905436c2accefbbb4b38b4e7c590cf88ab993db02cc142dfab8 gstreamer1-plugins-bad-free-libs-debuginfo-1.22.12-5.el9_6.4.x86_64.rpm SHA-256: 4a99e286961d9e5bb59b92ae63050424b8ba5869f71d6b309115a7ef2f09efff Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 SRPM gstreamer1-plugins-bad-free-1.22.12-5.el9_6.4.src.rpm SHA-256: f1da001b403b8556b9cb880a84c20a5d74bf0a54d3faf7cac7f036ba96a5e98b s390x gstreamer1-plugins-bad-free-1.22.12-5.el9_6.4.s390x.rpm SHA-256: 974f9ebb50d4664c921e08a07d4aa9fd39c6916c9f121eba80342639bdc8f879 gstreamer1-plugins-bad-free-debuginfo-1.22.12-5.el9_6.4.s390x.rpm SHA-256: 2baebcb1308490dbeb74cc0414ef0c495da40d0f7591efd3d2dd6deaff10cea6 gstreamer1-plugins-bad-free-debugsource-1.22.12-5.el9_6.4.s390x.rpm SHA-256: 86fcc6fecf8660bc802c491b202cb827b614eecff5fed91b6114908b3906d4c5 gstreamer1-plugins-bad-free-libs-1.22.12-5.el9_6.4.s390x.rpm SHA-256: 9c2a4e3268341f9ff01971fb258ff42d830cf32007020ed2f0a1ce302fb8369e gstreamer1-plugins-bad-free-libs-debuginfo-1.22.12-5.el9_6.4.s390x.rpm SHA-256: 2e3d6edfd088a093aa1dee9126edd7c1e00b055b88080a863836ad9e7949a58e Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 SRPM gstreamer1-plugins-bad-free-1.22.12-5.el9_6.4.src.rpm SHA-256: f1da001b403b8556b9cb880a84c20a5d74bf0a54d3faf7cac7f036ba96a5e98b ppc64le gstreamer1-plugins-bad-free-1.22.12-5.el9_6.4.ppc64le.rpm SHA-256: db61665d2f78a05d89eaba2ddac0f28e0be4df1301abebbe8d10d8f56780afd7 gstreamer1-plugins-bad-free-debuginfo-1.22.12-5.el9_6.4.ppc64le.rpm SHA-256: 3432827908c4ff76860883268d9f9c3cf8571eb45d9545d4422ee5912ef8cf55 gstreamer1-plugins-bad-free-debugsource-1.22.12-5.el9_6.4.ppc64le.rpm SHA-256: 6712df7298ade3e4f121ad433ab6a1d7daf74e8fef2123f52359ea391d0b019a gstreamer1-plugins-bad-free-libs-1.22.12-5.el9_6.4.ppc64le.rpm SHA-256: 8c84fd585514c7c97bdb9aef7a19e448625e67903c90fda8041283cc85ea6871 gstreamer1-plugins-bad-free-libs-debuginfo-1.22.12-5.el9_6.4.ppc64le.rpm SHA-256: 55f3c9222212ab48f54cb7ce1f643ca7d39d31d1e12fb7f2bad898df1a49d242 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 SRPM gstreamer1-plugins-bad-free-1.22.12-5.el9_6.4.src.rpm SHA-256: f1da001b403b8556b9cb880a84c20a5d74bf0a54d3faf7cac7f036ba96a5e98b aarch64 gstreamer1-plugins-bad-free-1.22.12-5.el9_6.4.aarch64.rpm SHA-256: e252c5f5c55ee5c181f35d7f1883dddc2ef18f1785057f71eecc64a9ced9d77c gstreamer1-plugins-bad-free-debuginfo-1.22.12-5.el9_6.4.aarch64.rpm SHA-256: 71edabf121dec24f701fa905103240b84f00790f2647d681436ef21fc226be1c gstreamer1-plugins-bad-free-debugsource-1.22.12-5.el9_6.4.aarch64.rpm SHA-256: c97b2806143b43c19834e4a7929f44a002070ff1d80923993fbd6e6358bf2672 gstreamer1-plugins-bad-free-libs-1.22.12-5.el9_6.4.aarch64.rpm SHA-256: a3ef9a44ee9c5892041164ab18bb082c12937adcea10347495289cd58a298b88 gstreamer1-plugins-bad-free-libs-debuginfo-1.22.12-5.el9_6.4.aarch64.rpm SHA-256: 1758313b855cf8d1a111d27d6c13a026e737928b0ceb97a46032a33db0d05514 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 SRPM gstreamer1-plugins-bad-free-1.22.12-5.el9_6.4.src.rpm SHA-