Amazon Linux 2023 Security Advisory: ALAS2023-2026-1917
Advisory Released Date: 2026-07-07
Advisory Updated Date: 2026-07-07
FAQs regarding Amazon Linux ALAS/CVE Severity
A denial of service vulnerability was found in GStreamer's AV1 codec parser in gst-plugins-bad. The gst_av1_parser_parse_tile_list_obu() function passes a byte count to a bit-reader API that expects a bit count, causing parser desynchronization. A remote attacker could trick a user into opening a specially crafted AV1 media file, triggering an assertion abort and causing the application to crash. (CVE-2026-52718)
An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser reads a segment length value from the bitstream without validating it against available data. A remote attacker could trick a user into opening a specially crafted JPEG file, causing downstream parsing to read beyond the provided input buffer, leading to a crash or potential information disclosure. (CVE-2026-52719)
A heap buffer overflow vulnerability was found in GStreamer's librfb (RFB/VNC client). The rectangle bounds check incorrectly validates area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebuffer. A remote attacker could set up a malicious VNC server and trick a user into connecting, resulting in an out-of-bounds heap write that could lead to code execution or a crash. (CVE-2026-52720)
Multiple out-of-bounds read vulnerabilities were found in GStreamer's pcapparse element. Malformed PCAP records can trigger reads beyond buffer boundaries during IPv4/TCP header parsing. This element is primarily used in debugging pipelines, limiting real-world exposure. A local attacker could trick a user into processing a specially crafted PCAP file, potentially leading to a crash or information disclosure. (CVE-2026-52721)
A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a specially crafted VMnc file, potentially causing a crash or information disclosure. (CVE-2026-52722)
A stack buffer overflow flaw was found in the GStreamer H.265 codec parser library (gst-plugins-bad). When parsing a buffering period SEI message, the parser uses an incorrect loop bound derived from cpb_cnt_minus1[i] (the loop index) instead of the sub-layer 0 CPB count cpb_cnt_minus1[0] from the referenced Sequence Parameter Set. A crafted H.265 video file or stream can cause the parser to write beyond the bounds of stack-allocated CPB delay arrays, resulting in a crash or potential stack memory corruption. (CVE-2026-53702)
Affected Packages:
gstreamer1-plugins-bad-free
Issue Correction:
Run dnf update gstreamer1-plugins-bad-free --releasever 2023.12.20260706 or dnf update --advisory ALAS2023-2026-1917 --releasever 2023.12.20260706 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
aarch64:
gstreamer1-plugin-openh264-debuginfo-1.24.10-1.amzn2023.0.6.aarch64
gstreamer1-plugin-openh264-1.24.10-1.amzn2023.0.6.aarch64
gstreamer1-plugins-bad-free-libs-debuginfo-1.24.10-1.amzn2023.0.6.aarch64
gstreamer1-plugins-bad-free-libs-1.24.10-1.amzn2023.0.6.aarch64
gstreamer1-plugins-bad-free-devel-1.24.10-1.amzn2023.0.6.aarch64
gstreamer1-plugins-bad-free-debuginfo-1.24.10-1.amzn2023.0.6.aarch64
gstreamer1-plugins-bad-free-1.24.10-1.amzn2023.0.6.aarch64
gstreamer1-plugins-bad-free-debugsource-1.24.10-1.amzn2023.0.6.aarch64
src:
gstreamer1-plugins-bad-free-1.24.10-1.amzn2023.0.6.src
x86_64:
gstreamer1-plugins-bad-free-libs-debuginfo-1.24.10-1.amzn2023.0.6.x86_64
gstreamer1-plugin-openh264-1.24.10-1.amzn2023.0.6.x86_64
gstreamer1-plugin-openh264-debuginfo-1.24.10-1.amzn2023.0.6.x86_64
gstreamer1-plugins-bad-free-libs-1.24.10-1.amzn2023.0.6.x86_64
gstreamer1-plugins-bad-free-devel-1.24.10-1.amzn2023.0.6.x86_64
gstreamer1-plugins-bad-free-debuginfo-1.24.10-1.amzn2023.0.6.x86_64
gstreamer1-plugins-bad-free-debugsource-1.24.10-1.amzn2023.0.6.x86_64
gstreamer1-plugins-bad-free-1.24.10-1.amzn2023.0.6.x86_64