Ubuntu USN-8863-1 Updates GStreamer Good Plugins for Four Vulnerabilities

Quick Answer

Ubuntu USN-8863-1 updates GStreamer Good Plugins for four media-processing flaws. The installable runtime plugin package is gstreamer1.0-plugins-good; gst-plugins-good1.0 identifies the source build. Update the affected installed binaries for the matching Ubuntu release and security or ESM channel.

Last verified: 2026-10-02 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.

Scope And Authority

Product scope	GStreamer Good Plugins on Ubuntu 16.04 ESM through Ubuntu 26.04 LTS
Advisory	USN-8863-1
CVEs	CVE-2026-17072, CVE-2026-73433, CVE-2026-73434, CVE-2026-88914
Authoritative release date	2026-10-01 16:46:33.027174 UTC
Authority revision date	No separate material revision date is stated by Ubuntu; verified against the first-party notice API
Affected versions	The Ubuntu releases and gst-plugins-good1.0 source packages enumerated in USN-8863-1.
Fixed source build (not an install command)	Ubuntu 18.04 ESM: gst-plugins-good1.0 1.14.5-0ubuntu1~18.04.3+esm4 / Ubuntu 20.04 ESM: gst-plugins-good1.0 1.16.3-0ubuntu1.3+esm4 / Ubuntu 22.04 LTS: gst-plugins-good1.0 1.20.3-0ubuntu1.10 / Ubuntu 24.04 LTS: gst-plugins-good1.0 1.24.2-1ubuntu1.8 / Ubuntu 26.04 LTS: gst-plugins-good1.0 1.28.2-2ubuntu0.4 / Ubuntu 16.04 ESM: gst-plugins-good1.0 1.8.3-1ubuntu0.5+esm4
CVSS base score	Not provided by the authority
CVSS severity	Not provided by the authority
Exploitation status	Not stated by the authority; no exploitation claim is inferred.

What Changed

The FLAC issue can disclose information; the two AVI parsing issues can cause denial of service, with one also exposing information. The closed-caption information-disclosure issue applies only to Ubuntu 20.04, 22.04, 24.04 and 26.04 in this notice, not every listed older release. Do not equate these impacts with a demonstrated code-execution exploit.

Fixed Binary Packages

Canonical's notice API lists these visible binary fixes. Match installed packages; this is not an instruction to install every listed package.

• bionic: gstreamer1.0-gtk3 1.14.5-0ubuntu1~18.04.3+esm4; gstreamer1.0-plugins-good 1.14.5-0ubuntu1~18.04.3+esm4; gstreamer1.0-pulseaudio 1.14.5-0ubuntu1~18.04.3+esm4; gstreamer1.0-qt5 1.14.5-0ubuntu1~18.04.3+esm4; libgstreamer-plugins-good1.0-0 1.14.5-0ubuntu1~18.04.3+esm4; libgstreamer-plugins-good1.0-dev 1.14.5-0ubuntu1~18.04.3+esm4.
• focal: gstreamer1.0-gtk3 1.16.3-0ubuntu1.3+esm4; gstreamer1.0-plugins-good 1.16.3-0ubuntu1.3+esm4; gstreamer1.0-pulseaudio 1.16.3-0ubuntu1.3+esm4; gstreamer1.0-qt5 1.16.3-0ubuntu1.3+esm4; libgstreamer-plugins-good1.0-0 1.16.3-0ubuntu1.3+esm4; libgstreamer-plugins-good1.0-dev 1.16.3-0ubuntu1.3+esm4.
• jammy: gstreamer1.0-gtk3 1.20.3-0ubuntu1.10; gstreamer1.0-plugins-good 1.20.3-0ubuntu1.10; gstreamer1.0-pulseaudio 1.20.3-0ubuntu1.10; gstreamer1.0-qt5 1.20.3-0ubuntu1.10; libgstreamer-plugins-good1.0-0 1.20.3-0ubuntu1.10; libgstreamer-plugins-good1.0-dev 1.20.3-0ubuntu1.10.
• noble: gstreamer1.0-gtk3 1.24.2-1ubuntu1.8; gstreamer1.0-plugins-good 1.24.2-1ubuntu1.8; gstreamer1.0-pulseaudio 1.24.2-1ubuntu1.8; gstreamer1.0-qt5 1.24.2-1ubuntu1.8; gstreamer1.0-qt6 1.24.2-1ubuntu1.8; libgstreamer-plugins-good1.0-0 1.24.2-1ubuntu1.8; libgstreamer-plugins-good1.0-dev 1.24.2-1ubuntu1.8.
• resolute: gstreamer1.0-gtk3 1.28.2-2ubuntu0.4; gstreamer1.0-plugins-good 1.28.2-2ubuntu0.4; gstreamer1.0-pulseaudio 1.28.2-2ubuntu0.4; gstreamer1.0-qt5 1.28.2-2ubuntu0.4; gstreamer1.0-qt6 1.28.2-2ubuntu0.4.
• xenial: gstreamer1.0-plugins-good 1.8.3-1ubuntu0.5+esm4; gstreamer1.0-plugins-good-doc 1.8.3-1ubuntu0.5+esm4; gstreamer1.0-pulseaudio 1.8.3-1ubuntu0.5+esm4; libgstreamer-plugins-good1.0-0 1.8.3-1ubuntu0.5+esm4; libgstreamer-plugins-good1.0-dev 1.8.3-1ubuntu0.5+esm4.

What To Validate Now

1. Inventory. Locate GStreamer Good Plugins on Ubuntu 16.04 ESM through Ubuntu 26.04 LTS deployments, versions, enabled features, exposure paths, owners, and dependent services.
2. Establish applicability. Match the installed Ubuntu release and binary packages to USN-8863-1. The source build identifies packaging provenance; it is not necessarily an installable package name. Do not transfer a version from another release or assume bundled upstream software is covered.
3. Remediate. Update the installed affected binary packages through the supported Ubuntu security or applicable Pro/ESM repository for that release. Use the USN package table, not the source-package name as an installation command. Keep the Ubuntu version epoch and suffix when checking the fixed build.
4. Validate. Check installed binary versions, restart long-running media consumers where required, and exercise benign FLAC, AVI and caption examples actually used by the service. Confirm playback/transcoding outputs and logs; do not feed malicious media to production. Package provenance for an application-bundled GStreamer remains a separate check.
5. Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.

Operational Cautions

Some fixes require Ubuntu Pro or ESM entitlement. Confirm repository state, test media pipelines and dependent applications, retain package-manager evidence, and do not infer exploitation from malformed-media reachability.

Evidence To Retain

• Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
• UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
• Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.

Related TechGeeks Resources

• TechGeeks Security Notice Center
• All Security Notices

Authoritative References

• USN-8863-1

Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.