gstreamer1 -- multiple vulnerabilities

2026-05-22 · VuXML entry

The GStreamer project reports multiple security vulnerabilities fixed in the 1.28.3 release: Six security vulnerabilities were addressed, including: Bounds check errors in MXF VANC packet handling. Use-after-free in GStreamer core buffer value deserialization. Out-of-bounds read in MXF demuxer temporal offset check. Out-of-bounds write in H.266/VVC parser when parsing PPS tile slices. Insufficient validation in …

Affected versions

• gstreamer1 < 1.28.3
• gstreamer1-plugins < 1.28.3
• gstreamer1-plugins-base < 1.28.3
• gstreamer1-plugins-good < 1.28.3
• gstreamer1-plugins-bad < 1.28.3
• gstreamer1-plugins-ugly < 1.28.3

By system

5 still vulnerable, 5 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.