Back Linuxsecurity

Debian 12 libav1-encoder Security Remote Code Trigger 2026

Linuxsecurity •LinuxSecurity Advisories • April 5, 2026

GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just anything else media-related. Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins. GStreamer Good Plugins is a collection of well-supported plugins of good quality and under the LGPL license. Update Information : Update to gstreamer-1.26.11.

GStreamer is a streaming media framework, based on graphs of filters which

operate on media data. Applications using this library can do anything

from real-time sound processing to playing videos, and just anything

else media-related. Its plugin-based architecture means that new data

types or processing capabilities can be added simply by installing new

GStreamer Good Plugins is a collection of well-supported plugins of

good quality and under the LGPL license.

Update to gstreamer-1.26.11.

* Fri Mar 27 2026 Sandro Mani - 1.26.11-1 - Update to 1.26.11 - Backport fix for CVE-2026-3083, CVE-2026-3085

[ 1 ] Bug #2447936 - CVE-2026-2920 mingw-gstreamer1: GStreamer: Arbitrary code execution via ASF file processing [fedora-all] [ 2 ] Bug #2448013 - CVE-2026-3084 mingw-gstreamer1: GStreamer: Remote Code Execution via integer underflow in H.266 Codec Parser [fedora-all] [ 3 ] Bug #2448019 - CVE-2026-2922 mingw-gstreamer1: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer [fedora-all] [ 4 ] Bug #2448020 - CVE-2026-2921 mingw-gstreamer1: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling [fedora-all] [ 5 ] Bug #2448021 - CVE-2026-2923 mingw-gstreamer1: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling [fedora-all] Read the Full Advisory

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-3cc99e7d09' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerabilities in GStreamer Affect Debian and Fedora Users Multiple critical vulnerabilities have been identified in the GStreamer framework, affecting Debian 12 and Fedora 42 systems. The vulnerabilities, including CVE-2026-3084 and CVE-2026-2920, allow for remote code execution through various media file processing methods. Attackers can exploit these vulnerabilities via specially crafted ASF files or through integer underflows in codec parsers. The vulnerabilities were published on March 13, 2026, and have been addressed in the latest updates to GStreamer version 1.26.11. Users are advised to apply the updates immediately to mitigate the risks. The affected systems include those running mingw-gstreamer1 packages. The advisory highlights the potential for significant impact if these vulnerabilities are exploited. Current status indicates that patches are available and should be implemented promptly. 3 sources 73

Extracted Entities

Companies (1)

Debian

CVEs (7)

CVE-2026-2920 CVE-2026-2921 CVE-2026-2922 CVE-2026-2923 CVE-2026-3083 CVE-2026-3084 CVE-2026-3085