{
  "threat_severity" : "Important",
  "public_date" : "2026-03-13T20:39:33Z",
  "bugzilla" : {
    "description" : "GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser",
    "id" : "2447492",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2447492"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.8",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-120",
  "details" : [ "GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\nThe specific flaw exists within the processing of Huffman tables. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28840.", "A flaw was found in GStreamer. A remote attacker can exploit a heap-based buffer overflow vulnerability in the GStreamer JPEG parser by providing a specially crafted JPEG file. This issue is caused by improper validation of Huffman table lengths, which can lead to arbitrary code execution in the context of the current process." ],
  "statement" : "This is an IMPORTANT heap-based buffer overflow vulnerability in the GStreamer JPEG parser. The flaw allows remote code execution when processing a specially crafted JPEG file due to improper validation of Huffman table lengths. Red Hat products utilizing GStreamer to process untrusted JPEG content are affected.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-03-31T00:00:00Z",
    "advisory" : "RHSA-2026:6259",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.1",
    "package" : "gstreamer1-plugins-bad-free-0:1.24.11-3.el10_1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-03-31T00:00:00Z",
    "advisory" : "RHSA-2026:6259",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.1",
    "package" : "gstreamer1-plugins-base-0:1.24.11-2.el10_1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-03-31T00:00:00Z",
    "advisory" : "RHSA-2026:6259",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.1",
    "package" : "gstreamer1-plugins-good-0:1.24.11-2.el10_1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-03-31T00:00:00Z",
    "advisory" : "RHSA-2026:6259",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.1",
    "package" : "gstreamer1-plugins-ugly-free-0:1.24.11-2.el10_1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10.0 Extended Update Support",
    "release_date" : "2026-04-20T00:00:00Z",
    "advisory" : "RHSA-2026:8854",
    "cpe" : "cpe:/o:redhat:enterprise_linux_eus:10.0",
    "package" : "gstreamer1-plugins-bad-free-0:1.24.11-3.el10_0"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10.0 Extended Update Support",
    "release_date" : "2026-04-20T00:00:00Z",
    "advisory" : "RHSA-2026:8854",
    "cpe" : "cpe:/o:redhat:enterprise_linux_eus:10.0",
    "package" : "gstreamer1-plugins-base-0:1.24.11-1.el10_0.1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10.0 Extended Update Support",
    "release_date" : "2026-04-20T00:00:00Z",
    "advisory" : "RHSA-2026:8854",
    "cpe" : "cpe:/o:redhat:enterprise_linux_eus:10.0",
    "package" : "gstreamer1-plugins-good-0:1.24.11-1.el10_0.2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10.0 Extended Update Support",
    "release_date" : "2026-04-20T00:00:00Z",
    "advisory" : "RHSA-2026:8854",
    "cpe" : "cpe:/o:redhat:enterprise_linux_eus:10.0",
    "package" : "gstreamer1-plugins-ugly-free-0:1.24.11-1.el10_0.1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
    "release_date" : "2026-04-13T00:00:00Z",
    "advisory" : "RHSA-2026:7673",
    "cpe" : "cpe:/o:redhat:rhel_els:7",
    "package" : "gstreamer1-plugins-bad-free-0:1.10.4-5.el7_9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
    "release_date" : "2026-04-13T00:00:00Z",
    "advisory" : "RHSA-2026:7673",
    "cpe" : "cpe:/o:redhat:rhel_els:7",
    "package" : "gstreamer1-plugins-base-0:1.10.4-4.el7_9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
    "release_date" : "2026-04-13T00:00:00Z",
    "advisory" : "RHSA-2026:7673",
    "cpe" : "cpe:/o:redhat:rhel_els:7",
    "package" : "gstreamer1-plugins-good-0:1.10.4-4.el7_9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-04-07T00:00:00Z",
    "advisory" : "RHSA-2026:6750",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "gstreamer1-plugins-bad-free-0:1.16.1-6.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-04-07T00:00:00Z",
    "advisory" : "RHSA-2026:6750",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "gstreamer1-plugins-base-0:1.16.1-6.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-04-07T00:00:00Z",
    "advisory" : "RHSA-2026:6750",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "gstreamer1-plugins-good-0:1.16.1-6.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-04-07T00:00:00Z",
    "advisory" : "RHSA-2026:6750",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8::crb",
    "package" : "gstreamer1-plugins-bad-free-0:1.16.1-6.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-04-07T00:00:00Z",
    "advisory" : "RHSA-2026:6750",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8::crb",
    "package" : "gstreamer1-plugins-base-0:1.16.1-6.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-04-07T00:00:00Z",
    "advisory" : "RHSA-2026:6750",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8::crb",
    "package" : "gstreamer1-plugins-good-0:1.16.1-6.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.2 Advanced Update Support",
    "release_date" : "2026-04-21T00:00:00Z",
    "advisory" : "RHSA-2026:9487",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.2",
    "package" : "gstreamer1-plugins-bad-free-0:1.16.1-4.el8_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.2 Advanced Update Support",
    "release_date" : "2026-04-21T00:00:00Z",
    "advisory" : "RHSA-2026:9487",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.2",
    "package" : "gstreamer1-plugins-base-0:1.16.1-3.el8_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.2 Advanced Update Support",
    "release_date" : "2026-04-21T00:00:00Z",
    "advisory" : "RHSA-2026:9487",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.2",
    "package" : "gstreamer1-plugins-good-0:1.16.1-3.el8_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
    "release_date" : "2026-04-21T00:00:00Z",
    "advisory" : "RHSA-2026:9446",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.4",
    "package" : "gstreamer1-plugins-bad-free-0:1.16.1-4.el8_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
    "release_date" : "2026-04-21T00:00:00Z",
    "advisory" : "RHSA-2026:9446",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.4",
    "package" : "gstreamer1-plugins-base-0:1.16.1-4.el8_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
    "release_date" : "2026-04-21T00:00:00Z",
    "advisory" : "RHSA-2026:9446",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.4",
    "package" : "gstreamer1-plugins-good-0:1.16.1-4.el8_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
    "release_date" : "2026-04-21T00:00:00Z",
    "advisory" : "RHSA-2026:9446",
    "cpe" : "cpe:/a:redhat:rhel_eus_long_life:8.4",
    "package" : "gstreamer1-plugins-bad-free-0:1.16.1-4.el8_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
    "release_date" : "2026-04-21T00:00:00Z",
    "advisory" : "RHSA-2026:9446",
    "cpe" : "cpe:/a:redhat:rhel_eus_long_life:8.4",
    "package" : "gstreamer1-plugins-base-0:1.16.1-4.el8_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
    "release_date" : "2026-04-21T00:00:00Z",
    "advisory" : "RHSA-2026:9446",
    "cpe" : "cpe:/a:redhat:rhel_eus_long_life:8.4",
    "package" : "gstreamer1-plugins-good-0:1.16.1-4.el8_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
    "release_date" : "2026-04-21T00:00:00Z",
    "advisory" : "RHSA-2026:9447",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.6",
    "package" : "gstreamer1-plugins-bad-free-0:1.16.1-4.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
    "release_date" : "2026-04-21T00:00:00Z",
    "advisory" : "RHSA-2026:9447",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.6",
    "package" : "gstreamer1-plugins-base-0:1.16.1-4.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
    "release_date" : "2026-04-21T00:00:00Z",
    "advisory" : "RHSA-2026:9447",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.6",
    "package" : "gstreamer1-plugins-good-0:1.16.1-4.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
    "release_date" : "2026-04-21T00:00:00Z",
    "advisory" : "RHSA-2026:9447",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.6",
    "package" : "gstreamer1-plugins-bad-free-0:1.16.1-4.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
    "release_date" : "2026-04-21T00:00:00Z",
    "advisory" : "RHSA-2026:9447",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.6",
    "package" : "gstreamer1-plugins-base-0:1.16.1-4.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
    "release_date" : "2026-04-21T00:00:00Z",
    "advisory" : "RHSA-2026:9447",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.6",
    "package" : "gstreamer1-plugins-good-0:1.16.1-4.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
    "release_date" : "2026-04-21T00:00:00Z",
    "advisory" : "RHSA-2026:9447",
    "cpe" : "cpe:/a:redhat:rhel_e4s:8.6",
    "package" : "gstreamer1-plugins-bad-free-0:1.16.1-4.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
    "release_date" : "2026-04-21T00:00:00Z",
    "advisory" : "RHSA-2026:9447",
    "cpe" : "cpe:/a:redhat:rhel_e4s:8.6",
    "package" : "gstreamer1-plugins-base-0:1.16.1-4.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
    "release_date" : "2026-04-21T00:00:00Z",
    "advisory" : "RHSA-2026:9447",
    "cpe" : "cpe:/a:redhat:rhel_e4s:8.6",
    "package" : "gstreamer1-plugins-good-0:1.16.1-4.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
    "release_date" : "2026-04-21T00:00:00Z",
    "advisory" : "RHSA-2026:9488",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.8",
    "package" : "gstreamer1-plugins-bad-free-0:1.16.1-4.el8_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
    "release_date" : "2026-04-21T00:00:00Z",
    "advisory" : "RHSA-2026:9488",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.8",
    "package" : "gstreamer1-plugins-base-0:1.16.1-4.el8_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
    "release_date" : "2026-04-21T00:00:00Z",
    "advisory" : "RHSA-2026:9488",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.8",
    "package" : "gstreamer1-plugins-good-0:1.16.1-5.el8_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
    "release_date" : "2026-04-21T00:00:00Z",
    "advisory" : "RHSA-2026:9488",
    "cpe" : "cpe:/a:redhat:rhel_e4s:8.8",
    "package" : "gstreamer1-plugins-bad-free-0:1.16.1-4.el8_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
    "release_date" : "2026-04-21T00:00:00Z",
    "advisory" : "RHSA-2026:9488",
    "cpe" : "cpe:/a:redhat:rhel_e4s:8.8",
    "package" : "gstreamer1-plugins-base-0:1.16.1-4.el8_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
    "release_date" : "2026-04-21T00:00:00Z",
    "advisory" : "RHSA-2026:9488",
    "cpe" : "cpe:/a:redhat:rhel_e4s:8.8",
    "package" : "gstreamer1-plugins-good-0:1.16.1-5.el8_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-03-31T00:00:00Z",
    "advisory" : "RHSA-2026:6300",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "gstreamer1-plugins-bad-free-0:1.22.12-5.el9_7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-03-31T00:00:00Z",
    "advisory" : "RHSA-2026:6300",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "gstreamer1-plugins-base-0:1.22.12-5.el9_7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-03-31T00:00:00Z",
    "advisory" : "RHSA-2026:6300",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "gstreamer1-plugins-good-0:1.22.12-5.el9_7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-03-31T00:00:00Z",
    "advisory" : "RHSA-2026:6300",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "gstreamer1-plugins-ugly-free-0:1.22.12-4.el9_7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
    "release_date" : "2026-04-20T00:00:00Z",
    "advisory" : "RHSA-2026:8876",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.0",
    "package" : "gstreamer1-plugins-bad-free-0:1.18.4-8.el9_0"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
    "release_date" : "2026-04-20T00:00:00Z",
    "advisory" : "RHSA-2026:8876",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.0",
    "package" : "gstreamer1-plugins-base-0:1.18.4-8.el9_0"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
    "release_date" : "2026-04-20T00:00:00Z",
    "advisory" : "RHSA-2026:8876",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.0",
    "package" : "gstreamer1-plugins-good-0:1.18.4-7.el9_0"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
    "release_date" : "2026-04-20T00:00:00Z",
    "advisory" : "RHSA-2026:8874",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.2",
    "package" : "gstreamer1-plugins-bad-free-0:1.18.4-9.el9_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
    "release_date" : "2026-04-20T00:00:00Z",
    "advisory" : "RHSA-2026:8874",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.2",
    "package" : "gstreamer1-plugins-base-0:1.18.4-8.el9_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
    "release_date" : "2026-04-20T00:00:00Z",
    "advisory" : "RHSA-2026:8874",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.2",
    "package" : "gstreamer1-plugins-good-0:1.18.4-8.el9_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Extended Update Support",
    "release_date" : "2026-04-20T00:00:00Z",
    "advisory" : "RHSA-2026:8857",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.4",
    "package" : "gstreamer1-plugins-bad-free-0:1.22.1-6.el9_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Extended Update Support",
    "release_date" : "2026-04-20T00:00:00Z",
    "advisory" : "RHSA-2026:8857",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.4",
    "package" : "gstreamer1-plugins-base-0:1.22.1-4.el9_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Extended Update Support",
    "release_date" : "2026-04-20T00:00:00Z",
    "advisory" : "RHSA-2026:8857",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.4",
    "package" : "gstreamer1-plugins-good-0:1.22.1-4.el9_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.6 Extended Update Support",
    "release_date" : "2026-04-20T00:00:00Z",
    "advisory" : "RHSA-2026:8862",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.6",
    "package" : "gstreamer1-plugins-bad-free-0:1.22.12-5.el9_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.6 Extended Update Support",
    "release_date" : "2026-04-20T00:00:00Z",
    "advisory" : "RHSA-2026:8862",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.6",
    "package" : "gstreamer1-plugins-base-0:1.22.12-5.el9_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.6 Extended Update Support",
    "release_date" : "2026-04-20T00:00:00Z",
    "advisory" : "RHSA-2026:8862",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.6",
    "package" : "gstreamer1-plugins-good-0:1.22.12-5.el9_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.6 Extended Update Support",
    "release_date" : "2026-04-20T00:00:00Z",
    "advisory" : "RHSA-2026:8862",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.6",
    "package" : "gstreamer1-plugins-ugly-free-0:1.22.12-4.el9_6"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "gstreamer",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "gstreamer",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-3082\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-3082\nhttps://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/7d3c258ed928cf59d126c8ea926b185f046f444c\nhttps://www.zerodayinitiative.com/advisories/ZDI-26-163/" ],
  "name" : "CVE-2026-3082",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}