Bug 2447496 (CVE-2026-2921)
| Summary: | CVE-2026-2921 GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in GStreamer. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. The flaw exists within the handling of palette data in AVI files, where a lack of proper validation of user-supplied data can lead to an integer overflow before writing to memory. An attacker can leverage this integer overflow to execute code in the context of the current process.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2448012, 2447995, 2447997, 2448020, 2448031 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-03-13 21:02:28 UTC
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:6259 https://access.redhat.com/errata/RHSA-2026:6259 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:6300 https://access.redhat.com/errata/RHSA-2026:6300 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:6750 https://access.redhat.com/errata/RHSA-2026:6750 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:7673 https://access.redhat.com/errata/RHSA-2026:7673 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:7850 https://access.redhat.com/errata/RHSA-2026:7850 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Via RHSA-2026:8876 https://access.redhat.com/errata/RHSA-2026:8876 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:8854 https://access.redhat.com/errata/RHSA-2026:8854 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:8874 https://access.redhat.com/errata/RHSA-2026:8874 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Extended Update Support Via RHSA-2026:8857 https://access.redhat.com/errata/RHSA-2026:8857 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:8862 https://access.redhat.com/errata/RHSA-2026:8862 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:9446 https://access.redhat.com/errata/RHSA-2026:9446 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Red Hat Enterprise Linux 8.6 Telecommunications Update Service Via RHSA-2026:9447 https://access.redhat.com/errata/RHSA-2026:9447 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Advanced Update Support Via RHSA-2026:9487 https://access.redhat.com/errata/RHSA-2026:9487 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:9488 https://access.redhat.com/errata/RHSA-2026:9488 |