The GStreamer project reports:
Multiple security issues were identified and fixed in the GStreamer framework.
- GStreamer-SA-2026-0093: Out-of-bounds read in MXF demuxer
- GStreamer-SA-2026-0094: Use of uninitialized memory in H.265 bitstream parser
- GStreamer-SA-2026-0095: Out-of-bounds read in H.264 RTP depayloader
- GStreamer-SA-2026-0096: Multiple out-of-bounds reads, null pointer write and denial of service in the VMnc video decoder
- GStreamer-SA-2026-0097: Local file disclosure via manifest references in adaptive streaming (HLS/DASH) demuxers
- GStreamer-SA-2026-0098: Out-of-bounds write and infinite loop when reading responses from a Festival speech synthesis server
- GStreamer-SA-2026-0099: Out-of-bounds read when parsing DVB short event descriptors
- GStreamer-SA-2026-0100: Out-of-bounds write in the RTP raw video depayloader with crafted stream dimensions
- GStreamer-SA-2026-0101: Out-of-bounds write in the ASF muxer when writing metadata with certain Unicode characters