Linux · Security advisory · April 7, 2026

ELSA-2026-6750: Security update for 6 packages

ELSA-2026-6750, released April 7, 2026, fixes 6 CVEs across 6 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
6
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0134
71st percentile

Priority of the 6 CVEs

Patch now 0 Urgent 0 High 6 Routine 0

Fixed package versions

ProductReleaseFixed in
gstreamer1-plugins-bad-freeol 80:1.16.1-6.0.1.el8_10
gstreamer1-plugins-bad-free-develol 80:1.16.1-6.0.1.el8_10
gstreamer1-plugins-baseol 80:1.16.1-6.0.1.el8_10
gstreamer1-plugins-base-develol 80:1.16.1-6.0.1.el8_10
gstreamer1-plugins-goodol 80:1.16.1-6.el8_10
gstreamer1-plugins-good-gtkol 80:1.16.1-6.el8_10

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2026-3085 gst-plugins-good1.0: GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability 8.8 0.0134 None reported
High CVE-2026-2921 gstreamer1-plugins-bad-free: GStreamer is a streaming media framework based on graphs of filters which operate on media data 8.8 0.0090 None reported
High CVE-2026-3083 gst-plugins-good1.0: GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability 8.8 0.0084 None reported
High CVE-2026-3082 gstreamer1-plugins-bad-free: GStreamer is a streaming media framework based on graphs of filters which operate on media data 8.8 0.0084 None reported
High CVE-2026-2920 gstreamer1.0-plugins-ugly: GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability 8.8 0.0080 None reported
High CVE-2026-2923 gstreamer1-plugins-bad-free: GStreamer is a streaming media framework based on graphs of filters which operate on media data 8.8 0.0076 None reported
Showing 1 to 6 of 6 1