| Package | gst-plugins-base1.0 |
|---|---|
| Version | 1.10.4-1+deb9u8 (stretch) |
| Related CVEs | CVE-2026-18297 |
A vulnerability was discovered in the Ogg demuxer of the GStreamer plugins base package. Insufficient validation of the length of user-supplied data while parsing Ogg files could result in a stack-based buffer overflow. A remote attacker could exploit this by tricking a user into opening a specially crafted media file, or visiting a web page that loads one, potentially leading to the execution of arbitrary code with the privileges of the application using GStreamer.
For Debian 9 stretch, these problems have been fixed in version 1.10.4-1+deb9u8.
We recommend that you upgrade your gst-plugins-base1.0 packages.
Further information about Extended LTS security advisories can be found in the dedicated section of our website.