Linux · Security advisory · April 1, 2026
ELSA-2026-6300: Security update for 9 packages
ELSA-2026-6300, released April 1, 2026, fixes 7 CVEs across 9 products. None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
7
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0134
71st percentile
Priority of the 7 CVEs
Patch now 0
Urgent 0
High 7
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| gstreamer1-plugins-bad-free | ol 9 | 0:1.22.12-5.el9_7 |
| gstreamer1-plugins-bad-free-devel | ol 9 | 0:1.22.12-5.el9_7 |
| gstreamer1-plugins-bad-free-libs | ol 9 | 0:1.22.12-5.el9_7 |
| gstreamer1-plugins-base | ol 9 | 0:1.22.12-5.el9_7 |
| gstreamer1-plugins-base-devel | ol 9 | 0:1.22.12-5.el9_7 |
| gstreamer1-plugins-base-tools | ol 9 | 0:1.22.12-5.el9_7 |
| gstreamer1-plugins-good | ol 9 | 0:1.22.12-5.el9_7 |
| gstreamer1-plugins-good-gtk | ol 9 | 0:1.22.12-5.el9_7 |
| gstreamer1-plugins-ugly-free | ol 9 | 0:1.22.12-4.el9_7 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2026-3085 | gst-plugins-good1.0: GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability | 8.8 | 0.0134 | None reported | |
| High | CVE-2026-2921 | gstreamer1-plugins-bad-free: GStreamer is a streaming media framework based on graphs of filters which operate on media data | 8.8 | 0.0090 | None reported | |
| High | CVE-2026-3083 | gst-plugins-good1.0: GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability | 8.8 | 0.0084 | None reported | |
| High | CVE-2026-3082 | gstreamer1-plugins-bad-free: GStreamer is a streaming media framework based on graphs of filters which operate on media data | 8.8 | 0.0084 | None reported | |
| High | CVE-2026-2920 | gstreamer1.0-plugins-ugly: GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability | 8.8 | 0.0080 | None reported | |
| High | CVE-2026-2923 | gstreamer1-plugins-bad-free: GStreamer is a streaming media framework based on graphs of filters which operate on media data | 8.8 | 0.0076 | None reported | |
| High | CVE-2026-2922 | gstreamer1.0-plugins-ugly: GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability | 8.8 | 0.0045 | None reported |
Showing 1 to 7 of 7
1