GStreamer Good Plugins, GStreamer Base Plugins Vulnerabilities — Ubuntu Security Update (USN-9038-1)

USN-9007-2 updates the GStreamer Good and Base Plugins on Ubuntu, fixing CVE-2026-3083 and CVE-2026-3085 — crafted network streams could crash GStreamer-based applications or execute arbitrary code. Update: sudo apt update && sudo apt upgrade for the gst packages and restart any media applications using them.

Critical 8.8 CVSS 2026-11-10

Ubuntu 20.04 Ubuntu 22.04

Was das unter einer SharedLicense-Lizenz bedeutet

GStreamer parses untrusted media streams — memory-safety flaws in network stream handling convert crafted streams into crashes or code execution inside media applications.

It was discovered that GStreamer Good Plugins did not properly handle
certain network streams. A remote attacker could possibly use this issue
to cause an application crash or execute arbitrary code. This issue only
affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2026-3083, CVE-2026-3085)

It was discovered that GStreamer Good Plugins incorrectly handled certain
Matroska files. An attacker could possibly use this issue to cause an
application crash, resulting in a denial of service. This issue only
affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2026-39043)

It was discovered that GStreamer Good Plugins incorrectly handled certain
WAV files. An attacker could possibly use this issue to make GStreamer
Good Plugins crash, resulting in a denial of service. This issue only
affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2026-39044)

It was discovered that GStreamer Good Plugins incorrectly handled certain
MP4 audio tracks. An attacker could possibly use this issue to cause an
application crash, resulting in a denial of service. This issue only
affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2026-46470)

It was discovered that GStreamer Good Plugins incorrectly handled certain
MP4 files. An attacker could possibly use this issue to make GStreamer Good
Plugins crash, resulting in a denial of service, or obtain sensitive
information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-46471)

It was discovered that GStreamer Good Plugins incorrectly handled certain
WavPack audio files. An attacker could possibly use this issue to cause an
application crash, resulting in a denial of service, or execute arbitrary
code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and
Ubuntu 20.04 LTS. (CVE-2026-53705)

It was discovered that GStreamer Good Plugins and GStreamer Base Plugins
incorrectly handled certain network streams. A remote attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. (CVE-2026-111183)

Häufig gestellte Fragen

What is USN-9007-2?

It is Ubuntu's security notice for the GStreamer Good and Base Plugins, fixing CVE-2026-3083 and CVE-2026-3085 — improper handling of certain network streams allowing crashes or arbitrary code execution in GStreamer-based applications.

Who is affected?

Ubuntu systems running media applications that use GStreamer to process network streams — media players, streaming servers and conversion tools.

How do I apply the fix?

Run sudo apt update && sudo apt upgrade for the gst packages and restart any media applications using GStreamer so they reload the patched plugins.

Why do GStreamer flaws keep appearing?

GStreamer parses dozens of media container and codec formats from untrusted sources — it is one of the most parser-dense libraries in the Linux desktop stack, which makes it a recurring CVE source.

Referenzen

Sicherheitshinweise

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen

Häufig gestellte Fragen

Verwandte Warnhinweise

System auf Schwachstellen prüfen