Ubuntu USN-8855-1 Fixes GStreamer Bad Plugins Vulnerability
Tech GuruQuick Answer
USN-8855-1 fixes CVE-2026-19387, a multi-channel WAV parsing flaw in GStreamer Bad Plugins that can crash the process or possibly execute code. Update the installed gstreamer1.0-plugins-bad binary for the matching Ubuntu release. Several listed builds, including 22.04 and 24.04, require the Ubuntu Pro ESM Apps channel; a routine update without that repository may not supply this fix.
Confirm Scope And Apply The Supported Fix
What to do now: Find players, previewers and media-processing jobs that load the affected plugin package, not only machines with a GStreamer command-line tool. Update each relevant runtime, including separately maintained containers or application bundles, then restart affected long-running consumers through their supported process.
Last verified: 2026-10-02 UTC against USN-8855-1 JSON, including the WAV trigger, binary names and release-specific pockets.
Scope And Authority
| Product scope | GStreamer Bad Plugins vulnerability on Ubuntu 26.04 LTS (resolute), Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy), Ubuntu 20.04 ESM (focal), Ubuntu 18.04 ESM (bionic), Ubuntu 16.04 ESM (xenial), Ubuntu 14.04 ESM (trusty) |
|---|---|
| Advisory | USN-8855-1 |
| CVE | CVE-2026-19387 |
| Authoritative release date | 2026-09-30 16:05:01.041749 UTC |
| Authority revision date | No separate material revision date is stated by Ubuntu; verified against the first-party notice API. |
| Affected versions | The Ubuntu releases and source packages enumerated in USN-8855-1: Ubuntu 26.04 LTS (resolute), Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy), Ubuntu 20.04 ESM (focal), Ubuntu 18.04 ESM (bionic), Ubuntu 16.04 ESM (xenial), Ubuntu 14.04 ESM (trusty). |
| Fixed version | Selected runtime binaries; update those installed and their required dependencies. The linked USN has the full package list: bionic: gstreamer1.0-plugins-bad 1.14.5-0ubuntu1~18.04.1+esm2 (esm-apps)focal: gstreamer1.0-plugins-bad 1.16.3-0ubuntu1.1+esm2 (esm-apps)jammy: gstreamer1.0-plugins-bad 1.20.3-0ubuntu1.1+esm3 (esm-apps)noble: gstreamer1.0-plugins-bad 1.24.2-1ubuntu4+esm2 (esm-apps)resolute: gstreamer1.0-plugins-bad 1.28.2-1ubuntu1.2 (security)trusty: gstreamer1.0-plugins-bad 1.2.4-1~ubuntu1.1+esm1 (esm-infra-legacy)xenial: gstreamer1.0-plugins-bad 1.8.3-1ubuntu0.2+esm2 (esm-apps-legacy) |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
Canonical identifies incorrect size validation for multi-channel audio blocks in a crafted WAV file. The parser runs within the consuming application's privilege boundary, so exposure depends on which inputs reach that application. A successful playback test through a different decoder does not demonstrate that the affected GStreamer path was exercised.
What To Validate Now
- Trace the input route. Identify the application or worker accepting WAV input and the plugin package it actually loads. Distinguish the Ubuntu-managed copy from bundled libraries and separate runtime images.
- Verify repository access. Use the binary version and pocket for the installed release. Ubuntu 18.04-24.04 use ESM Apps; 14.04 and 16.04 use Legacy Support channels; 26.04 has the listed security-pocket build.
- Update and renew consumers. Apply the supported binary update, save user work or drain jobs as needed, and restart affected applications/workers. Keep their existing least-privilege and input restrictions.
- Test benign multi-channel WAV input. Exercise the real preview, playback or conversion path with authorized media and verify expected channels, output and error handling. Do not use a malicious sample or infer coverage from a different decoder's success.
- Record what ran. Retain package origin/version, consumer restart and test-path evidence. Resolve crashes or plugin-load errors before wider deployment, without enabling unrelated plugins or broad file access as a shortcut.
Operational Cautions
The source-package name gst-plugins-bad1.0 is not the binary named by the USN for installation. ESM entitlement must be checked against the actual repository, not inferred from the age of the LTS release. This notice does not state exploitation, and these workflow checks were not performed here.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
