gstreamer1 -- multiple vulnerabilities

2026-03-07 · CVE-2026-1940, CVE-2026-3082, CVE-2026-2921, CVE-2026-2922, CVE-2026-2920, CVE-2026-2923, CVE-2026-3083, CVE-2026-3085, CVE-2026-3086, CVE-2026-3081, CVE-2026-3084 · VuXML entry

The GStreamer project reports multiple security vulnerabilities fixed in the 1.28.1 release: Twelve security vulnerabilities were addressed, including: Out-of-bounds reads and writes in the H.266 video parser, WAV parser, MP4 and ASF demuxers, and DVB subtitle decoder. Integer overflows in the RIFF parser and Huffman table handling in the JPEG parser. Stack buffer overflows in the RTP QDM2 depayloader and H.266 …

Affected versions

• gstreamer1 < 1.28.1
• gstreamer1-plugins < 1.28.1
• gstreamer1-plugins-good < 1.28.1
• gstreamer1-plugins-bad < 1.28.1
• gstreamer1-plugins-ugly < 1.28.1

By system

5 still vulnerable, 5 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.