gstreamer1 -- multiple vulnerabilities

2026-05-22 · CVE-2026-5056, CVE-2026-39043, CVE-2026-39044, CVE-2026-46469, CVE-2026-46470, CVE-2026-46472 · VuXML entry

The GStreamer project reports multiple security vulnerabilities fixed in the 1.28.2 release: Several security vulnerabilities were addressed, including: H.264 video parser NULL pointer dereference when freeing SPS/MVC data. Integer overflows in the AV1 LEB128 parser, H.266/VVC video parser, and WAV parser cue handling. Heap buffer overflow in the Matroska demuxer. Assertion failures in the FLV demuxer on corrupted …

Affected versions

• gstreamer1 < 1.28.2
• gstreamer1-plugins < 1.28.2
• gstreamer1-plugins-base < 1.28.2
• gstreamer1-plugins-good < 1.28.2
• gstreamer1-plugins-bad < 1.28.2
• gstreamer1-plugins-ugly < 1.28.2

By system

5 still vulnerable, 5 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.