Back Linuxsecurity

Fedora 44 Updates Its GStreamer Plugins to Version 1.28.8

Linuxsecurity •LinuxSecurity Advisories • October 28, 2026

Two serious PHP flaws could let an attacker run code without logging in. See which setups and PHP versions are affected ×

GStreamer is a streaming media framework, based on graphs of elements which

operate on media data.

This package contains plug-ins that aren't tested

well enough, or the code is not of good enough quality.

Update to gstreamer-1.28.8.

* Fri Oct 16 2026 Sandro Mani - 1.28.8-1 - Update to 1.28.8 * Sun Sep 27 2026 Sandro Mani - 1.28.7-2 - Bump

[ 1 ] Bug #2513017 - CVE-2026-19387 mingw-gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder [fedora-all] [ 2 ] Bug #2547479 - CVE-2026-18649 mingw-gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders [fedora-all] [ 3 ] Bug #2552106 - CVE-2026-86476 mingw-gstreamer1-plugins-base: gst-plugins-base: heap buffer overflow via unvalidated GstVideoMeta plane extents in gst_video_frame_map_id and video_meta_deserialize [fedora-all] [ 4 ] Bug #2555426 - CVE-2026-46471 mingw-gstreamer1-plugins-good: gstreamer1-plugins-good: information disclosure via out-of-bounds read during MP4 parsing [fedora-all] [ 5 ] Bug #2555428 - CVE-202...

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-343461e9d1' at the command line. For more information, refer to the dnf documentation available at

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Identified in Fedora GStreamer Plugins Update On October 16, 2026, Fedora released updates for GStreamer plugins to version 1.28.8, addressing several vulnerabilities. Notably, CVE-2026-19387, a high-severity heap out-of-bounds write flaw, was published on August 10, 2026. Other vulnerabilities include CVE-2026-18649, which has a high CVSS score of 7.5 and was published on August 6, 2026, and CVE-2026-86476, with a CVSS of 8.4, published on October 14, 2026. CVE-2026-46471, a medium-severity issue, was disclosed on October 16, 2026. The vulnerabilities affect various GStreamer plugins, potentially allowing for code execution and memory issues. Users are advised to update their systems using the 'dnf' update program to mitigate these risks. 4 sources 57

Extracted Entities

CVEs (4)

CVE-2026-18649 CVE-2026-19387 CVE-2026-46471 CVE-2026-86476

CWE Weaknesses (4)

CWE-122 - Heap-based Buffer Overflow CWE-125 - Out-of-bounds Read CWE-200 - Exposure of Sensitive Information CWE-787 - Out-of-bounds Write