The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9446 advisory.

    GStreamer is a streaming media framework based on graphs of filters which operate on media data. The     gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

    Security Fix(es):

    * GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser     (CVE-2026-3082)

    * GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay     (CVE-2026-3085)

    * GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling     (CVE-2026-2921)

    * GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:6259 advisory.

    GStreamer is a streaming media framework based on graphs of filters which operate on media data. The     gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

    Security Fix(es):

    * GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920)

    * GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser     (CVE-2026-3082)

    * GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay     (CVE-2026-3085)

    * GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling     (CVE-2026-2921)

    * GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083)

    * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922)

    * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling     (CVE-2026-2923)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9488 advisory.

    GStreamer is a streaming media framework based on graphs of filters which operate on media data. The     gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

    Security Fix(es):

    * GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser     (CVE-2026-3082)

    * GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay     (CVE-2026-3085)

    * GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling     (CVE-2026-2921)

    * GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-7850 advisory.

    - Security update CVE-2026-2921 [Orabug: 39201593]

    gstreamer-plugins-good

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19024 advisory.

    - Add patches for CVE-2026-2923 and CVE-2026-3082       Resolves: RHEL-156114, RHEL-156172
    - Add patch for CVE-2026-2921       Resolves: RHEL-156122

    gstreamer1-plugins-good
    - Add patch for CVE-2026-3083 and CVE-2026-3085       Resolves: RHEL-156133, RHEL-156112
    - Add patches for CVE-2026-2920 and CVE-2026-2922       Resolves: RHEL-156044, RHEL-156165

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1776777715 advisory.

  - GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows     remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this     library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation. The specific flaw exists within the processing of X-QDM RTP payload elements. When parsing     the packetid element, the process does not properly validate user-supplied data, which can result in a     write past the end of an allocated array. An attacker can leverage this vulnerability to execute code in     the context of the current process. Was ZDI-CAN-28850. (CVE-2026-3083)

  - GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability     allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with     this library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation. The specific flaw exists within the processing of X-QDM RTP payloads. The issue results     from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based     buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
    Was ZDI-CAN-28851. (CVE-2026-3085)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_6750 advisory.

    * GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920)

    * GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser     (CVE-2026-3082)

    * GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay     (CVE-2026-3085)

    * GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling     (CVE-2026-2921)

    * GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083)

    * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling     (CVE-2026-2923)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has gstreamer1 packages installed that are affected by multiple vulnerabilities:

  - GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability     allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with     this library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation. The specific flaw exists within the processing of X-QDM RTP payloads. The issue results     from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based     buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
    Was ZDI-CAN-28851. (CVE-2026-3085)

  - GStreamer H266 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This     vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer.
    Interaction with this library is required to exploit this vulnerability but attack vectors may vary     depending on the implementation. The specific flaw exists within the parsing of H266 sei messages. The     issue results from the lack of proper validation of the length of user-supplied data prior to copying it     to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the     context of the current process. Was ZDI-CAN-27381. (CVE-2025-6663)

  - GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability     allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with     this library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation. The specific flaw exists within the processing of stream headers within ASF files. The     issue results from the lack of proper validation of the length of user-supplied data prior to copying it     to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the     context of the current process. Was ZDI-CAN-28843. (CVE-2026-2920)

  - GStreamer RIFF Palette Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows     remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this     library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation. The specific flaw exists within the handling of palette data in AVI files. The issue     results from the lack of proper validation of user-supplied data, which can result in an integer overflow     before writing to memory. An attacker can leverage this vulnerability to execute code in the context of     the current process. Was ZDI-CAN-28854. (CVE-2026-2921)

  - GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability     allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with     this library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation. The specific flaw exists within the processing of video packets. The issue results from     the lack of proper validation of user-supplied data, which can result in a write past the end of an     allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the     current process. Was ZDI-CAN-28845. (CVE-2026-2922)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
308355	RHEL 8 : gstreamer1-plugins-bad-free, gstreamer1-plugins-base, and gstreamer1-plugins-good (RHSA-2026:9446)	Nessus	Red Hat Local Security Checks	2026/4/21	2026/4/21	high
304420	RHEL 10 : gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free (RHSA-2026:6259)	Nessus	Red Hat Local Security Checks	2026/3/31	2026/3/31	high
309087	RHEL 8 : gstreamer1-plugins-bad-free, gstreamer1-plugins-base, and gstreamer1-plugins-good (RHSA-2026:9488)	Nessus	Red Hat Local Security Checks	2026/4/21	2026/4/21	high
321149	Oracle Linux 7 : gstreamer-plugins-base / and / gstreamer-plugins-good (ELSA-2026-7850)	Nessus	Oracle Linux Local Security Checks	2026/6/15	2026/6/15	high
327056	Oracle Linux 10 : gstreamer1-plugins-bad-free, / gstreamer1-plugins-base, / gstreamer1-plugins-good, / and / gstreamer1-plugins-ugly-free (ELSA-2026-19024)	Nessus	Oracle Linux Local Security Checks	2026/7/15	2026/7/15	high
359666	AlmaLinux 9.2 [TuxCare] Security Update: gstreamer1-plugins-good / gstreamer1-plugins-good-gtk / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1776777715)	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/10/1	high
353543	Rocky Linux 8 [CIQ] Security Update: gstreamer1-plugins-bad-free / gstreamer1-plugins-bad-free-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_6750)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
343589	NewStart CGSL MAIN 7.02 : gstreamer1 Multiple Vulnerabilities (NS-SA-2026-0093)	Nessus	NewStart CGSL Local Security Checks	2026/9/8	2026/9/8	high

检测

插件搜索

high

high

high

high

high

high

high

high