The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:19024 advisory.

    GStreamer is a streaming media framework based on graphs of filters which operate on media data. The     gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

    Security Fix(es):

    * GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920)

    * GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser     (CVE-2026-3082)

    * GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay     (CVE-2026-3085)

    * GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling     (CVE-2026-2921)

    * GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083)

    * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922)

    * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling     (CVE-2026-2923)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0391 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-2920:
    GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability     allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with     this library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation.

    The specific flaw exists within the processing of stream headers within ASF files. The issue results from     the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length     heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the     current process. Was ZDI-CAN-28843.

    CVE-2026-2921:
    GStreamer RIFF Palette Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows     remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this     library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation.

    The specific flaw exists within the handling of palette data in AVI files. The issue results from the lack     of proper validation of user-supplied data, which can result in an integer overflow before writing to     memory. An attacker can leverage this vulnerability to execute code in the context of the current process.
    Was ZDI-CAN-28854.

    CVE-2026-2923:
    GStreamer DVB Subtitles Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows     remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this     library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation.

    The specific flaw exists within the handling of coordinates. The issue results from the lack of proper     validation of user-supplied data, which can result in a write past the end of an allocated buffer. An     attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-     CAN-28838.

    CVE-2026-3082:
    GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability     allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with     this library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation.

    The specific flaw exists within the processing of Huffman tables. The issue results from the lack of     proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based     buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
    Was ZDI-CAN-28840.

    CVE-2026-3083:
    GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows     remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this     library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation.

    The specific flaw exists within the processing of X-QDM RTP payload elements. When parsing the packetid     element, the process does not properly validate user-supplied data, which can result in a write past the     end of an allocated array. An attacker can leverage this vulnerability to execute code in the context of     the current process. Was ZDI-CAN-28850.

    CVE-2026-3085:
    GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability     allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with     this library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation.

    The specific flaw exists within the processing of X-QDM RTP payloads. The issue results from the lack of     proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An     attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-     CAN-28851.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:19024 advisory.

    * GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920)

    * GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser     (CVE-2026-3082)

    * GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay     (CVE-2026-3085)

    * GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling     (CVE-2026-2921)

    * GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083)

    * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922)

    * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling     (CVE-2026-2923)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0765 advisory.

    Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:

    CVE-2026-2921:
    GStreamer RIFF Palette Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows     remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this     library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation.

    The specific flaw exists within the handling of palette data in AVI files. The issue results from the lack     of proper validation of user-supplied data, which can result in an integer overflow before writing to     memory. An attacker can leverage this vulnerability to execute code in the context of the current process.
    Was ZDI-CAN-28854.

    CVE-2026-3082:
    GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability     allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with     this library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation.

    The specific flaw exists within the processing of Huffman tables. The issue results from the lack of     proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based     buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
    Was ZDI-CAN-28840.

    CVE-2026-3083:
    GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows     remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this     library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation.

    The specific flaw exists within the processing of X-QDM RTP payload elements. When parsing the packetid     element, the process does not properly validate user-supplied data, which can result in a write past the     end of an allocated array. An attacker can leverage this vulnerability to execute code in the context of     the current process. Was ZDI-CAN-28850.

    CVE-2026-3085:
    GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability     allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with     this library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation.

    The specific flaw exists within the processing of X-QDM RTP payloads. The issue results from the lack of     proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An     attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-     CAN-28851.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_6300 advisory.

    * GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920)

    * GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser     (CVE-2026-3082)

    * GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay     (CVE-2026-3085)

    * GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling     (CVE-2026-2921)

    * GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083)

    * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922)

    * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling     (CVE-2026-2923)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_6259 advisory.

    * GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920)

    * GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser     (CVE-2026-3082)

    * GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay     (CVE-2026-3085)

    * GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling     (CVE-2026-2921)

    * GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083)

    * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922)

    * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling     (CVE-2026-2923)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
315442	RHEL 10 : gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free (RHSA-2026:19024)	Nessus	Red Hat Local Security Checks	5/19/2026	5/19/2026	high
316671	TencentOS Server 3: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, and gstreamer1-plugins-good (TSSA-2026:0391)	Nessus	Tencent Local Security Checks	5/26/2026	5/26/2026	high
317976	RockyLinux 10 : gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free (RLSA-2026:19024)	Nessus	Rocky Linux Local Security Checks	5/29/2026	5/29/2026	high
330260	TencentOS Server 2: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, and gstreamer1-plugins-good (TSSA-2026:0765)	Nessus	Tencent Local Security Checks	7/28/2026	7/28/2026	high
353983	Rocky Linux 9 [CIQ] Security Update: gstreamer1-plugins-bad-free / gstreamer1-plugins-bad-free-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_6300)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/1/2026	high
357265	Rocky Linux 10.1 [CIQ] Security Update: gstreamer1-plugins-bad-free / gstreamer1-plugins-bad-free-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_6259)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/1/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high