gstreamer-plugins-bad-free vulnerabilities
CVEs whose affected-version data names the gstreamer-plugins-bad-free package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-59692High· 7.5A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin
A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed into a fixed-size 2048-byte stack buffer without bounds checking. A remote un…
CVE-2026-59691High· 7.1A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin
A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path wri…
CVE-2026-14935Low· 3.7Gstreamer1-plugins-bad-free: gstreamer: webrtcbin accepts remote sdp without a=fingerprint due to inverted presence check
A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto() function contains an inverted boolean condition that causes it to accept remote SDP offers or answers that lack the required a=fingerprint attrib…