Red Hat GStreamer Good Update Fixes Three RHEL 7 Flaws
Tech GuruQuick Answer
Red Hat's RHSA-2026:70264 updates gstreamer1-plugins-good to 1.10.4-4.el7_9.3 for RHEL 7 Extended Lifecycle Support. The three flaws affect untrusted RTP streams or crafted AVI files. Use the entitled RHEL 7 package; the newer upstream GStreamer version is not the version to compare against Red Hat's backport.
Confirm Scope And Apply The Supported Fix
What to do now: Identify applications loading the Good Plugins, especially unauthenticated RTP pipelines and AVI preview/import paths. Update the matching ELS RPM and arrange application restart or reload as required to use the new library.
Last verified: 2026-09-22 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | RHEL 7 ELS gstreamer1-plugins-good packages |
|---|---|
| Advisory | RHSA-2026:70264 |
| CVEs | CVE-2026-18649, CVE-2026-73433, CVE-2026-73434 |
| Authoritative release date | 2026-09-22 15:06:44 UTC |
| Recorded source timestamp (historical snapshot) | 2026-09-22 15:47:09 UTC |
| Affected versions | RHEL 7 ELS gstreamer1-plugins-good RPMs before 1.10.4-4.el7_9.3, matched to the installed architecture. |
| Fixed version | gstreamer1-plugins-good 1.10.4-4.el7_9.3 |
| CVSS base score | 6.1 / 6.6 / 7.5 (CVSS v3.1) |
| CVSS severity | Medium to High |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
CVE-2026-18649 can exhaust memory while H.264/H.265 RTP fragments accumulate without a terminating marker. Authenticated SRTP/DTLS-SRTP reduces that unauthenticated path; local-file playback is not affected by this CVE. The other two flaws are in AVI parsing: CVE-2026-73433 can read or write outside a buffer while handling FUJIFILM metadata, and CVE-2026-73434 can read beyond video-field descriptors and crash the application.
What To Validate Now
- Inventory. Locate RHEL 7 ELS gstreamer1-plugins-good packages deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Match installed Good Plugins RPMs and architectures to the ELS advisory. Determine whether applications process untrusted RTP or AVI content; the RTP authentication boundary does not rule out the separate AVI issues.
- Remediate. Apply gstreamer1-plugins-good 1.10.4-4.el7_9.3 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Confirm the fixed RPM and that relevant applications have loaded the updated plugin. Exercise approved RTP playback and AVI import/preview samples, checking memory use and stability without submitting exploit media to production.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
