gstreamer1 -- multiple vulnerabilities

2026-06-29 · CVE-2026-12891, CVE-2026-12892, CVE-2026-12893, CVE-2026-52717, CVE-2026-52718, CVE-2026-52719, CVE-2026-52720, CVE-2026-52721, CVE-2026-52722, CVE-2026-53703, CVE-2026-53704, CVE-2026-53705 · VuXML entry

The GStreamer project reports: Multiple security issues were identified and fixed in the GStreamer framework. GStreamer-SA-2026-0030: Missing bounds checks in RTCP SDES packet parsing GStreamer-SA-2026-0031: Integer overflow and truncation in MXF demuxer GStreamer-SA-2026-0032: Out-of-bounds read and write in XMP tag parser GStreamer-SA-2026-0033: Out-of-bounds read and modification of const data in ID3v2 parser …

Affected versions

• gstreamer1-libav, gstreamer1-plugins, gstreamer1-plugins-bad, gstreamer1-plugins-good, gstreamer1-plugins-ugly < 1.28.4

By system

5 still vulnerable, 5 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.