There are packages installed that are affected by a vulnerability referenced in the following CVE:

  CVE-2026-39044


The version of gstreamer1-plugins-good installed on the remote host is prior to 1.18.4-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3788 advisory.

    Heap buffer overflow in the Matroska (MKV) demuxer when calculating decompressed buffer sizes for     bz2-compressed tracks. The issue occurs due to missing parentheses in the buffer size calculation, causing     incorrect memory allocation and potential out-of-bounds writes. (from     https://gstreamer.freedesktop.org/security/sa-2026-0022.html) (CVE-2026-39043)

    An integer overflow in the WAV parser (wavparse) when handling malformed WAV files with cue chunks. The     vulnerability occurs during buffer size validation when calculating the expected size for cue entries     (ncues * 24), where insufficient bounds checking allows integer overflow during the multiplication     operation. (from https://gstreamer.freedesktop.org/security/sa-2026-0021.html) (CVE-2026-39044)

    A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially     crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in     gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes     decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects     both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to     the allocation size type. A remote attacker could use this flaw to crash an application or potentially     execute arbitrary code by convincing a user to open a malicious WavPack audio file. (CVE-2026-53705)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX     (gstreamer)). Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12,     25.0.4 and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via     multiple protocols to compromise Oracle Java SE, Oracle JavaFX. Successful attacks require human     interaction from a person other than the attacker. Successful attacks of this vulnerability can result in     unauthorized read access to a subset of Oracle Java SE, Oracle JavaFX accessible data and unauthorized     ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle JavaFX. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2026-39044)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6359 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6359-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     June 21, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : gst-plugins-good1.0     CVE ID         : CVE-2026-1940 CVE-2026-3083 CVE-2026-3085 CVE-2026-39043                      CVE-2026-39044

    Multiple security vulnerabilities were discovered in plugins for the     GStreamer media framework and its codecs and demuxers, which may result     in denial of service or potentially the execution of arbitrary code if     a malformed media file is opened.

    For the stable distribution (trixie), these problems have been fixed in     version 1.26.2-1+deb13u2.

    We recommend that you upgrade your gst-plugins-good1.0 packages.

    For the detailed security status of gst-plugins-good1.0 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/gst-plugins-good1.0

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4837 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4837-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                  Andreans Henriksson     October 15, 2026                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : gst-plugins-good1.0     Version        : 1.22.0-5+deb12u4     CVE ID         : CVE-2025-47183 CVE-2026-1940 CVE-2026-3083 CVE-2026-3085                      CVE-2026-17072 CVE-2026-18298 CVE-2026-18299 CVE-2026-39043                      CVE-2026-39044 CVE-2026-53705 CVE-2026-73433 CVE-2026-73434                      CVE-2026-88914

    Multiple vulnerabilities were discovered in gst-plugins-good1.0, a collection     of plugins for the GStreamer multimedia framework. Processing specially     crafted media files or RTP streams could result in denial of service,     disclosure of information or execution of arbitrary code.

    For Debian 12 bookworm, these problems have been fixed in version     1.22.0-5+deb12u4.

    We recommend that you upgrade your gst-plugins-good1.0 packages.

    For the detailed security status of gst-plugins-good1.0 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/gst-plugins-good1.0

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 26.0.2 and 27 releases of Oracle Java SE installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory.

  - Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX     (WebKitGTK)). Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4     and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Oracle Java SE, Oracle JavaFX. Successful attacks require human interaction from a     person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle     Java SE, Oracle JavaFX. (CVE-2026-43660)

  - Vulnerability in Oracle Java SE (component: Java plugin). Supported versions that are affected are Oracle     Java SE: 8u503 and 8u503-perf. Difficult to exploit vulnerability allows low privileged attacker with logon     to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE. While the vulnerability is     in Oracle Java SE, attacks may significantly impact additional products (scope change). (CVE-2026-91484)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf,     11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle     GraalVM Enterprise Edition: 21.3.19.1.1. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for     JDK, Oracle GraalVM Enterprise Edition as well as unauthorized update, insert or delete access to some of     Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized     read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition     accessible data. (CVE-2026-91415)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1926 advisory.

    Heap buffer overflow in the Matroska (MKV) demuxer when calculating decompressed buffer sizes for     bz2-compressed tracks. The issue occurs due to missing parentheses in the buffer size calculation, causing     incorrect memory allocation and potential out-of-bounds writes. (from     https://gstreamer.freedesktop.org/security/sa-2026-0022.html) (CVE-2026-39043)

    An integer overflow in the WAV parser (wavparse) when handling malformed WAV files with cue chunks. The     vulnerability occurs during buffer size validation when calculating the expected size for cue entries     (ncues * 24), where insufficient bounds checking allows integer overflow during the multiplication     operation. (from https://gstreamer.freedesktop.org/security/sa-2026-0021.html) (CVE-2026-39044)

    A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially     crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in     gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes     decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects     both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to     the allocation size type. A remote attacker could use this flaw to crash an application or potentially     execute arbitrary code by convincing a user to open a malicious WavPack audio file. (CVE-2026-53705)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 05aadfcc-55f5-11f1-915c-8974b59277b5 advisory.

    The GStreamer project reports multiple security vulnerabilities fixed in the 1.28.2 release:
    Several security vulnerabilities were addressed, including:
    These could lead to application crashes, memory exhaustion, or potentially arbitrary code execution.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
461968	Echo: gst-plugins-good1.0: security update to 1.26.2-1+deb13u2	Tenable Cloud Security	Echo Local Security Checks	10/2/2026	10/2/2026	critical
461968	Echo: gst-plugins-good1.0: security update to 1.26.2-1+deb13u2	Tenable Self-Hosted Container Security	Echo Local Security Checks	10/2/2026	10/2/2026	critical
325568	Amazon Linux 2 : gstreamer1-plugins-good, --advisory ALAS2-2026-3788 (ALAS-2026-3788)	Nessus	Amazon Linux Local Security Checks	7/8/2026	7/15/2026	high
321202	Linux Distros Unpatched Vulnerability : CVE-2026-39044	Nessus	Misc.	6/16/2026	11/11/2026	critical
321873	Debian dsa-6359 : gstreamer1.0-gtk3 - security update	Nessus	Debian Local Security Checks	6/21/2026	6/21/2026	high
366229	Debian dla-4837 : gstreamer1.0-gtk3 - security update	Nessus	Debian Local Security Checks	10/15/2026	11/6/2026	high
372932	Oracle Java SE Multiple Vulnerabilities (October 2026 CPU)	Nessus	Misc.	10/28/2026	10/29/2026	medium
327407	Amazon Linux 2023 : gstreamer1-plugins-good, gstreamer1-plugins-good-gtk (ALAS2023-2026-1926)	Nessus	Amazon Linux Local Security Checks	7/16/2026	7/17/2026	high
316658	FreeBSD : gstreamer1 -- multiple vulnerabilities (05aadfcc-55f5-11f1-915c-8974b59277b5)	Nessus	FreeBSD Local Security Checks	5/26/2026	5/26/2026	critical

Detections

Analytics

Plugins Search

critical

critical

high

critical

high

high

medium

high

critical