Ubuntu fixes GStreamer plugin flaws that can crash or run code
Original title: USN-9038-1: GStreamer Good Plugins, GStreamer Base Plugins vulnerabilities
Network-stream and Matroska issues are limited to Ubuntu 16.04, 18.04, and 20.04 LTS; the notice is cut off.
Ubuntu security notice USN-9038-1 covers vulnerabilities in GStreamer Good Plugins. A remote attacker could possibly crash an application or execute arbitrary code by using certain network streams (CVE-2026-3083, CVE-2026-3085). Certain Matroska files could cause a denial of service (CVE-2026-39043). Those issues affected only Ubuntu 16.04 LTS, 18.04 LTS, and 20.04 LTS. The notice also starts a WAV-file issue before the text ends.
Unconfirmed: The notice is truncated after the WAV-file issue, so later flaws and fixed versions are not shown.
- CVE-2026-3083 and CVE-2026-3085 involve mishandled network streams.
- CVE-2026-39043 is a Matroska handling denial of service.
- The title also names GStreamer Base Plugins, but that detail is not in the snippet.
Impact: application crash or possible arbitrary code execution
| Product | Affected |
|---|---|
| GStreamer Good Plugins | Ubuntu 16.04 LTS, 18.04 LTS, and 20.04 LTS |
- 1.Apply USN-9038-1 updates on the affected Ubuntu releases.
- Products
- GStreamer Good PluginsUbuntu
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-3085+1 related CVE | GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability | 8.8 | <1% | ||
| CVE-2026-39043 | — | — | — |
From the original article
It was discovered that GStreamer Good Plugins did not properly handle certain network streams. A remote attacker could possibly use this issue to cause an application crash or execute arbitrary code. This issue only affected Ubuntu 16.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.