An update for gstreamer1-plugins-bad-free is now available for openEuler-22.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-4828 Final 1.0 1.0 2026-11-11 Initial 2026-11-11 2026-11-11 openEuler SA Tool V1.0 2026-11-11 gstreamer1-plugins-bad-free security update An update for gstreamer1-plugins-bad-free is now available for openEuler-22.03-LTS-SP4 GStreamer is a pipeline-based multi media framework that links together a wide variety of media processing systems to complete complex workflows, based on graphs of filters which operate on media data. This package contains plug-ins that are not tested well enough yet, or the code is not of good enough quality. Security Fix(es): A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. This can lead to application crash, denial of service, memory corruption, or potentially arbitrary code execution when untrusted media is processed.(CVE-2026-19387) A heap buffer overflow vulnerability was found in GStreamer's librfb (RFB/VNC client). The rectangle bounds check incorrectly validates area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebuffer. A remote attacker could set up a malicious VNC server and trick a user into connecting, resulting in an out-of-bounds heap write that could lead to code execution or a crash.(CVE-2026-52720) A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a specially crafted VMnc file, potentially causing a crash or information disclosure.(CVE-2026-52722) An update for gstreamer1-plugins-bad-free is now available for openEuler-22.03-LTS-SP4/openEuler-24.03-LTS-SP1/openEuler-24.03-LTS-SP3/openEuler-24.03-LTS-SP4/openEuler-20.03-LTS-SP1/openEuler-20.09/openEuler-22.03-LTS-SP3/openEuler-24.03-LTS/openEuler-24.03-LTS-SP2. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High gstreamer1-plugins-bad-free https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4828 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-19387 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-52720 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-52722 https://nvd.nist.gov/vuln/detail/CVE-2026-19387 https://nvd.nist.gov/vuln/detail/CVE-2026-52720 https://nvd.nist.gov/vuln/detail/CVE-2026-52722 openEuler-22.03-LTS-SP4 gstreamer1-plugins-bad-free-1.16.2-18.oe2203sp4.aarch64.rpm gstreamer1-plugins-bad-free-debuginfo-1.16.2-18.oe2203sp4.aarch64.rpm gstreamer1-plugins-bad-free-debugsource-1.16.2-18.oe2203sp4.aarch64.rpm gstreamer1-plugins-bad-free-devel-1.16.2-18.oe2203sp4.aarch64.rpm gstreamer1-plugins-bad-free-1.16.2-18.oe2203sp4.src.rpm gstreamer1-plugins-bad-free-1.16.2-20.oe2203sp4.src.rpm gstreamer1-plugins-bad-free-1.16.2-20.oe2203sp4.x86_64.rpm gstreamer1-plugins-bad-free-debuginfo-1.16.2-20.oe2203sp4.x86_64.rpm gstreamer1-plugins-bad-free-debugsource-1.16.2-20.oe2203sp4.x86_64.rpm gstreamer1-plugins-bad-free-devel-1.16.2-20.oe2203sp4.x86_64.rpm A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. This can lead to application crash, denial of service, memory corruption, or potentially arbitrary code execution when untrusted media is processed. 2026-11-11 CVE-2026-19387 openEuler-22.03-LTS-SP4 High 7.6 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H gstreamer1-plugins-bad-free security update 2026-11-11 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4828 A heap buffer overflow vulnerability was found in GStreamer's librfb (RFB/VNC client). The rectangle bounds check incorrectly validates area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebuffer. A remote attacker could set up a malicious VNC server and trick a user into connecting, resulting in an out-of-bounds heap write that could lead to code execution or a crash. 2026-11-11 CVE-2026-52720 openEuler-22.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H gstreamer1-plugins-bad-free security update 2026-11-11 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4828 A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a specially crafted VMnc file, potentially causing a crash or information disclosure. 2026-11-11 CVE-2026-52722 openEuler-22.03-LTS-SP4 High 7.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H gstreamer1-plugins-bad-free security update 2026-11-11 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4828