<div class="container">
<h1>Security update for gstreamer-rtsp-server, gstreamer-plugins-ugly, gstreamer-plugins-rs, gstreamer-plugins-libav, gstreamer-plugins-good, gstreamer-plugins-base, gstreamer-plugins-bad, gstreamer-docs, gstreamer-devtools, gstreamer</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2026:20686-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2026-03-05T17:33:21Z</td>
</tr>
<tr>
<th>Rating:</th>
<td>moderate</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1237097">bsc#1237097</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1248053">bsc#1248053</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>
Cross-References:
</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-55159.html">CVE-2025-55159</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-55159</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.8</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-55159</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.8</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-55159</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.1</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">SUSE Linux Micro 6.2</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that solves one vulnerability and has one fix can now be installed.</p>
<h2>Description:</h2>
<p>This update for gstreamer-rtsp-server, gstreamer-plugins-ugly, gstreamer-plugins-rs, gstreamer-plugins-libav, gstreamer-plugins-good, gstreamer-plugins-base, gstreamer-plugins-bad, gstreamer-docs, gstreamer-devtools, gstreamer fixes the following issues:</p>
<p>Changes in gstreamer-rtsp-server:</p>
<ul>
<li>Update to version 1.26.7:</li>
<li>Fix issues with G_DISABLE_CHECKS & G_DISABLE_ASSERT.</li>
<li>rtsp-server: tests: Switch to fixtures to ensure pool shutdown</li>
<li>rtsp-server: tests: Fix a few memory leaks</li>
</ul>
<p>Changes in gstreamer-plugins-ugly:</p>
<ul>
<li>Update to version 1.26.7:</li>
<li>No changes, stable version bump only.</li>
</ul>
<p>Changes in gstreamer-plugins-rs:</p>
<ul>
<li>
<p>Update to version 1.26.7+git0.6ab75814:</p>
</li>
<li>
<p>tracers: Fix inverted append logic when writing log files</p>
</li>
<li>
<p>threadshare:</p>
<ul>
<li>examples: standalone: also handle buffer lists</li>
<li>Pad push_list: downgrade Pad flushing log level</li>
<li>sinks: fix / handle query()</li>
<li>backpressure: abort pending items on flush start</li>
<li>udpsink: fix panic recalculating latency from certain
executors</li>
<li>audiotestsrc:
. support more Audio formats
. use AudioInfo
. fix latency
. act as a pseudo live source by default</li>
<li>runtime task: execute action in downward transition</li>
<li>example cleanups</li>
<li>udpsink: distinguish sync status for latency & report added
latency</li>
<li>sink elements: implement <code>send_event</code></li>
<li>dataqueue elements: report min and max latency</li>
</ul>
</li>
<li>
<p>rtp:</p>
<ul>
<li>Add linear audio (L8, L16, L24) RTP payloaders / depayloaders</li>
</ul>
</li>
<li>
<p>rtp: basedepay: reuse last PTS, when possible</p>
</li>
<li>skia: Update to skia-safe 0.89</li>
<li>mp4: Update to mp4-atom 0.9</li>
<li>Update dependencies</li>
<li>webrtc: livekit: Drop connection lock after take()</li>
<li>onvifmetadatapay: copy metadata from source buffer</li>
<li>fallbacksrc: Fix custom source reuse case</li>
<li>add <code>rust-tls-native-roots</code> feature to the <code>reqwest</code> dep</li>
<li>
<p>rtpamrpay2:</p>
<ul>
<li>Actually forward the frame quality indicator</li>
<li>Set frame quality indicator flag</li>
</ul>
</li>
<li>
<p>Add patch to fix reproducibility of package build (boo#1237097)</p>
</li>
<li>
<p>Update to version 1.26.6+git20.e287e869:</p>
</li>
<li>
<p>Fix some new clippy 1.90 warnings</p>
</li>
<li>colordetect: Don't use deprecated color_name API</li>
<li>deny: Update</li>
<li>quinn: Update to web-transport-quinn 0.8</li>
<li>skia: Update to skia-safe 0.88</li>
<li>Update Cargo.lock</li>
<li>Allow windows-sys 0.61 too</li>
<li>intersink: add sync property</li>
<li>meson: Fix .pc files installation and simplify build output
handling. This also fixes the .pc file install directory and
ensures that the .pc files are only installed when static
builds is enabled.</li>
<li>
<p>Drop devel subpackage following upstream changes.</p>
</li>
<li>
<p>Update to version 1.26.6:</p>
</li>
<li>
<p>aws: Ensure task stopping on paused-to-ready state change</p>
</li>
<li>
<p>fallbacksrc:</p>
<ul>
<li>Don't panic during retries if the element was shut down in
parallel</li>
<li>Don't restart source if the element is just being shut down</li>
<li>Fix some custom source deadlocks</li>
<li>Fix sources only being restarted once</li>
</ul>
</li>
<li>
<p>gtk4: Try importing dmabufs withouth DMA_DRM caps</p>
</li>
<li>inter: Give the appsrc/appsink a name that has the parent
element as prefix</li>
<li>mp4: Skip tests using x264enc if it does not exist</li>
<li>rtpgccbwe: avoid clamp() panic when min_bitrate > max_bitrate</li>
<li>rtpmp4gdepay2: allow only constantduration with neither
constantsize nor sizelength set</li>
<li>rtprecv: fix race condition on first buffer</li>
<li>speechmatics: Specify rustls as an explicit dependency</li>
<li>spotify: update to librespot 0.7</li>
<li>
<p>threadshare:</p>
<ul>
<li>add a blocking adapter element</li>
<li>always use block_on_or_add_subtask</li>
<li>audiotestsrc: fix setting samples-per-buffer...</li>
<li>blocking_adapter: fix Since marker in docs</li>
<li>fix resources not available when preparing asynchronously</li>
<li>fix ts-inter test one_to_one_up_first</li>
<li>have: have Task log its obj</li>
<li>intersink: return from blocking tasks when stopping</li>
<li>inter: update doc example</li>
<li>runtime/pad: lower log level pushing Buffer to flushing pad</li>
<li>separate blocking & throttling schedulers</li>
<li>update examples</li>
<li>Update to getifaddrs 0.5</li>
<li>Fix macOS build post getifaddrs 0.5 update</li>
<li>Bump up getiffaddrs to 0.1.5 and revert "udp: avoid
getifaddrs in android"</li>
<li>Reapply "udp: avoid getifaddrs in android"</li>
</ul>
</li>
<li>
<p>transcriberbin: Fix some deadlocks</p>
</li>
<li>Update dependencies</li>
<li>webrtc: Migrate to warp 0.4 and switch to tokio-rustls</li>
<li>webrtc/signalling: Fix setting of host address</li>
<li>ci: add script to check readme against plugins list</li>
<li>Fix various new clippy 1.89 warnings</li>
<li>Don't suggest running cargo cinstall after cargo cbuild</li>
<li>
<p>meson: Isolate built plugins from cargo target directory</p>
</li>
<li>
<p>Update to version 1.26.5+git11.949807a4 (boo#1248053,
CVE-2025-55159):</p>
</li>
<li>
<p>rtprecv: fix race condition on first buffer</p>
</li>
<li>threadshare: intersink: return from blocking tasks when
stopping</li>
<li>threadshare: inter: store upstream latency in InterContext</li>
<li>threadshare: add a blocking adapter element</li>
<li>transcriberbin: Fix settings/state lock order violation in
set_property()</li>
<li>transcriberbin: Don't keep state locked while querying upstream
latency</li>
<li>threadshare: audiotestsrc: fix setting samples-per-buffer...</li>
<li>rtpgccbwe: avoid clamp() panic when min_bitrate > max_bitrate</li>
<li>fallbacksrc: Don't restart source if the element is just being
shut down</li>
<li>aws: Ensure task stopping on paused-to-ready state change</li>
<li>fallbacksrc: Don't panic during retries if the element was shut
down in parallel</li>
<li>
<p>Update Cargo.lock.</p>
</li>
<li>
<p>Update to version 1.26.5:</p>
</li>
<li>
<p>awstranscriber2, awstranslate: Handle multiple stream-start
event</p>
</li>
<li>ceaX08overlay: support ANY caps features, allowing e.g.
memory:GLMemory if downstream supports the overlay composition
meta</li>
<li>hlsmultivariantsink: Fix master playlist version</li>
<li>rtprecv: Drop state lock before chaining RTCP packets from the
RTP chain function</li>
<li>Add rtpbin2 examples</li>
<li>rtpmp4apay2: fix payload size prefix</li>
<li>rtp: threadshare: fix some property ranges</li>
<li>mpegtslivesrc: Remove leftover debug message</li>
<li>ts-audiotestsrc fixes</li>
<li>threadshare: fix flush for ts-queue ts-proxy & ts-intersrc</li>
<li>threadshare: fix regression in ts-proxysrc</li>
<li>threadshare: improvements to some elements</li>
<li>threadshare: Enable windows Win32_Networking feature</li>
<li>threadshare: queue & proxy: fix race condition stopping</li>
<li>threadshare: Also enable windows Win32_Networking_WinSock
feature</li>
<li>tracers: pipeline-snapshot: reduce WebSocket connection log
level</li>
<li>tracers: queue-levels: add support for threadshare DataQueue
related elements</li>
<li>tracers: Update to etherparse 0.19</li>
<li>transcriberbin: Fix handling of upstream latency query</li>
<li>webrtcsink: Move videorate before videoconvert and videoscale
to avoid processing frames that would be dropped</li>
<li>
<p>Fix various new clippy 1.89 warnings</p>
</li>
<li>
<p>Update to version 1.26.4:</p>
</li>
<li>aws: s3hlssink: Write to S3 on OutputStream flush</li>
<li>cea708mux: fix clipping function</li>
<li>dav1ddec: Use video decoder base class latency reporting API</li>
<li>elevenlabssynthesizer: fix running time checks</li>
<li>gopbuffer: Push GOPs in order of time on EOS</li>
<li>gtk4: Improve color-state fallbacks for unknown values</li>
<li>gtk4: Add YCbCr memory texture formats</li>
<li>gtk4: Promote set_caps debug log to info</li>
<li>hlssink3: Fix a comment typo</li>
<li>hlssink3: Use closed fragment location in playlist generation</li>
<li>livekit: add room-timeout</li>
<li>mccparse: Convert "U" to the correct byte representation</li>
<li>mp4mux: add TAI timestamp element and muxing</li>
<li>threadshare: add a ts-rtpdtmfsrc element</li>
<li>rtp: Update to rtcp-types 0.2</li>
<li>rtpsend: Don't configure a zero min RTCP interval for senders</li>
<li>rtpbin2: Fix handling of unknown PTs and don't warn about
incomplete RTP caps to allow for bundling</li>
<li>rtpbin2: Improve rtcp-mux support</li>
<li>rtpbin2: fix race condition on serialized Queries</li>
<li>rtpbin2: sync: fix race condition</li>
<li>rtprecv optimize src pad scheduling</li>
<li>rtprecv: fix SSRC collision event sent in wrong direction</li>
<li>skia: Add harfbuzz, freetype and fontconfig as dependencies in
the meson build</li>
<li>tttocea{6,7}08: Disallow pango markup from input caps</li>
<li>ts-intersrc: handle dynamic inter-ctx changes</li>
<li>threadshare: src elements: don't pause the task in downward
state transitions</li>
<li>webrtc: sink: avoid recursive locking of the session</li>
<li>webrtcsink: fix deadlock on error setting remote description</li>
<li>webrtcsink: add mitigation modes parameter and signal</li>
<li>webrtc: fix Safari addIceCandidate crash</li>
<li>webrtc-api: Set default bundle policy to max-bundle</li>
<li>WHIP client: emit shutdown after DELETE request</li>
<li>Fix various new clippy 1.88 warnings</li>
<li>
<p>Update dependencies</p>
</li>
<li>
<p>Update to version 1.26.3:</p>
</li>
<li>
<p>Add new speech synthesis element around ElevenLabs API</p>
</li>
<li>cea708mux: fix another WouldOverflow case</li>
<li>cea708mux: support configuring a limit to how much data will be
pending.</li>
<li>cea708overlay: also reset the output size on flush stop</li>
<li>gcc: handle out of order packets</li>
<li>fmp4mux: Fix panic on late GOP</li>
<li>livekit: expose a connection state property</li>
<li>mp4mux: add taic box</li>
<li>mp4mux: test the trak structure</li>
<li>pcap_writer: Make target-property and pad-path properties
writable again</li>
<li>skia: Don't build skia plugin by default for now</li>
<li>threadshare: cleanups & usability improvements</li>
<li>threadshare: sync runtime with latest async-io</li>
<li>threadshare: fix kqueue reactor</li>
<li>threadshare: Update to getifaddrs 0.2</li>
<li>threadshare: add new thread-sharing inter elements</li>
<li>threadshare: add a ts-rtpdtmfsrc element</li>
<li>transcriberbin: fix naming of subtitle pads</li>
<li>tttocea708: don't panic if a new service would overflow</li>
<li>webrtc: android: Update Gradle and migrate to
FindGStreamerMobile</li>
<li>webrtc: add new examples for stream selection over data channel</li>
<li>webrtcsrc: the webrtcbin get-transceiver index is not
mlineindex</li>
<li>webrtcsrc: send CustomUpstream events over control channel ..</li>
<li>webrtcsink: Don't require encoder element for pre-encoded
streams</li>
<li>webrtcsink: Don't reject caps events if the codec_data changes</li>
<li>whip: server: pick session-id from the endpoint if specified</li>
<li>cargo: add config file to force
CARGO_NET_GIT_FETCH_WITH_CLI=true</li>
<li>Cargo.lock, deny: Update dependencies and log duplicated
targo-lexicon</li>
<li>Update windows-sys dependency from ">=0.52, <=0.59" to ">=0.52,
<=0.60"</li>
<li>deny: Add override for windows-sys 0.59</li>
<li>deny: Update lints</li>
<li>cargo_wrapper: Fix backslashes being parsed as escape codes on
Windows</li>
<li>Fixes for Clock: non-optional return types</li>
<li>Rename relationmeta plugin to analytics</li>
</ul>
<p>Changes in gstreamer-plugins-libav:</p>
<ul>
<li>
<p>Update to version 1.26.7:</p>
</li>
<li>
<p>No changes, stable versionbump only.</p>
</li>
</ul>
<p>Changes in gstreamer-plugins-good:</p>
<ul>
<li>
<p>Update to version 1.26.7:</p>
</li>
<li>
<p>matroskamux: Properly check if pads are EOS in find_best_pad</p>
</li>
<li>qtdemux:<ul>
<li>Bad performance with GoPro videos containing FDSC metadata
tracks</li>
<li>Fix open/seek perf for GoPro files with SOS track</li>
<li>Handle unsupported channel layout tags gracefully</li>
<li>Set channel-mask to 0 for unknown layout tags</li>
</ul>
</li>
<li>rtspsrc: Send RTSP keepalives in TCP/interleaved modes</li>
<li>v4l2:<ul>
<li>Add GstV4l2Error handling in gst_v4l2_get_capabilities</li>
<li>Fix memory leak for DRM caps negotiation</li>
</ul>
</li>
<li>v4l2transform: reconfigure v4l2object only if respective caps
changed</li>
<li>
<p>Fix issues with G_DISABLE_CHECKS & G_DISABLE_ASSERT</p>
</li>
<li>
<p>Update to version 1.26.6:</p>
</li>
<li>
<p>adaptivedemux2: fix crash due to log</p>
</li>
<li>adaptivedemux2: Crash in logging when "Dropping EOS before next
period"</li>
<li>hlsdemux2: Fix parsing of byterange and init map directives</li>
<li>mpg123audiodec: Always break the decoding loop and relay
downstream flow errors upstream</li>
<li>v4l2: Add support for WVC1 and WMV3</li>
<li>
<p>Monorepo: dv plugin requires explicit enablement now for a
build using the Meson subproject fallback</p>
</li>
<li>
<p>Update to version 1.26.5:</p>
</li>
<li>
<p>4l2: fix memory leak for dynamic resolution change</p>
</li>
<li>
<p>videorate, imagefreeze: add support for JPEG XS</p>
</li>
<li>
<p>Update to version 1.26.4:</p>
</li>
<li>
<p>adaptivedemux2: Fixed reverse playback</p>
</li>
<li>matroskademux: Send tags after seeking</li>
<li>qtdemux: Fix incorrect FourCC used when iterating over sbgp
atoms</li>
<li>qtdemux: Incorrect sibling type used in sbgp iteration loop</li>
<li>rtph265pay: add profile-id, tier-flag, and level-id to output
rtp caps</li>
<li>rtpjpeg: fix copying of quant data if it spans memory segments</li>
<li>soup: Disable range requests when talking to Python's
http.server</li>
<li>v4l2videodec: need replace acquired_caps on set_format success</li>
<li>Fix various valgrind/test errors when GST_DEBUG is enabled</li>
<li>More valgrind and test fixes</li>
<li>
<p>Various ASAN fixes</p>
</li>
<li>
<p>Update to version 1.26.3:</p>
</li>
<li>
<p>aacparse: Fix counting audio channels in program_config_element</p>
</li>
<li>adaptivedemux2: free cancellable when freeing transfer task</li>
<li>dashdemux2: Fix seeking in a stream with gaps</li>
<li>decodebin wavparse cannot pull header</li>
<li>imagefreeze: fix not negotiate log when stop</li>
<li>osxvideosink: Use gst_pad_push_event() and post navigation
messages</li>
<li>qml6glsink: Allow configuring if the item will consume input
events</li>
<li>qtmux: Update chunk offsets when converting stco to co64 with
faststart</li>
<li>splitmuxsink: Only send closed message once per open fragment</li>
<li>rtph265depay: CRA_NUT can also start an (open) GOP</li>
<li>rtph265depay: fix codec_data generation</li>
<li>rtspsrc: Don't emit error during close if server is EOF</li>
<li>twcc: Fix reference timestamp wrapping (again)</li>
<li>v4l2: Fix possible internal pool leak</li>
<li>v4l2object: Add support for colorimetry bt2100-pq and 1:4:5:3</li>
<li>wavparse: Don't error out always when parsing acid chunks</li>
</ul>
<p>Changes in gstreamer-plugins-base:</p>
<ul>
<li>
<p>Update to version 1.26.7:</p>
</li>
<li>
<p>discoverer: Mark gst_discoverer_stream_info_list_free() as
transfer full</p>
</li>
<li>riff: Add channel reorder maps for 3 and 7 channel audio</li>
<li>sdp: proper usage of gst_buffer_append</li>
<li>videorate: fix assert fail due to invalid buffer duration</li>
<li>
<p>Fix build error with glib < 2.68</p>
</li>
<li>
<p>Update to version 1.26.6:</p>
</li>
<li>
<p>decodebin3: Update stream tags</p>
</li>
<li>rtpbasedepayload: Avoid potential use-after free</li>
<li>rtspconnection: Add get_url and get_ip return value annotation</li>
<li>gst_rtsp_connection_get_url return value transfer annotation
missing</li>
<li>videometa: Fix valgrind warning when deserializing video meta</li>
<li>videorate: don't hold the reference to the buffer in drop-only
mode</li>
<li>gst-device-monitor-1.0: Fix device-path regression on Windows</li>
<li>gst-device-monitor-1.0: Add quoting for powershell and cmd</li>
<li>
<p>Monorepo: opengl, vorbis, plugins require explicit enablement
now for a build using the Meson subproject fallback</p>
</li>
<li>
<p>Update to version 1.26.5:</p>
</li>
<li>
<p>audioconvert: mix-matrix causes caps negotiation failure</p>
</li>
<li>decodebin3: Don't error on an incoming ONVIF metadata stream</li>
<li>gloverlay: Recompute geometry when caps change, and load
texture after stopping and starting again</li>
<li>uridecodebin3: Add missing locking and NULL checks when adding
URIs to messages</li>
<li>uridecodebin3: segfault in update_message_with_uri() if no
decoder available</li>
<li>videorate, imagefreeze: add support for JPEG XS</li>
<li>gst-device-monitor-1.0: Add shell quoting for launch lines</li>
<li>gst-device-monitor-1.0: Fix criticals, and also accept utf8 in
launch lines</li>
<li>
<p>gst-device-monitor-1.0: Use gst_print instead of g_print</p>
</li>
<li>
<p>Update to version 1.26.4:</p>
</li>
<li>
<p>Revert "streamsynchronizer: Consider streams having received
stream-start as waiting"</p>
</li>
<li>alsa: free conf cache under valgrind</li>
<li>gst-device-monitor: Fix caps filter splitting</li>
<li>Fix various valgrind/test errors when GST_DEBUG is enabled</li>
<li>More valgrind and test fixes</li>
<li>
<p>Various ASAN fixes</p>
</li>
<li>
<p>Update to version 1.26.3:</p>
</li>
<li>
<p>GstAudioAggregator: fix structure unref in peek_next_sample()</p>
</li>
<li>audioconvert: Fix setting mix-matrix when input caps changes</li>
<li>encodebasebin: Duplicate encoding profile in property setter</li>
<li>gl: simplify private
gst_gl_gst_meta_api_type_tags_contain_only()</li>
<li>osxvideosink: Use gst_pad_push_event() and post navigation
messages</li>
<li>playsink: Fix race condition in stream synchronizer pad cleanup
during state changes</li>
<li>python: Fix pulling events from appsink</li>
<li>streamsynchronizer: Consider streams having received
stream-start as waiting</li>
<li>urisourcebin: Text tracks are no longer set as sparse stream in
urisourcebin's multiqueue</li>
</ul>
<p>Changes in gstreamer-plugins-bad:</p>
<ul>
<li>
<p>Update to version 1.26.7:</p>
</li>
<li>
<p>cuda: Fix runtime kernel compile with CUDA 13.0</p>
</li>
<li>d3d12convert: Fix crop meta support</li>
<li>d3d12deinterlace: Fix passthrough handling</li>
<li>gst: Fix a few small leaks</li>
<li>matroskamux: Properly check if pads are EOS in find_best_pad</li>
<li>tsdemux: Directly forward Opus AUs without opus_control_header</li>
<li>tsmux: Write a full Opus channel configuration if no matching
Vorbis one is found</li>
<li>unixfd: Fix case of buffer with big payload</li>
<li>vacompositor: Correct scale-method properties</li>
<li>webrtc: nice: Fix a use-after-free and a mem leak</li>
<li>Fix all compiler warnings on Fedora</li>
<li>
<p>Fix issues with G_DISABLE_CHECKS & G_DISABLE_ASSERT</p>
</li>
<li>
<p>Update to version 1.26.6:</p>
</li>
<li>
<p>analytics: always add GstTensorMeta</p>
</li>
<li>cccombiner: Crash fixes</li>
<li>curlsmtpsink: adapt to date formatting issue</li>
<li>decklinkvideosrc: fix decklinkvideosrc becomes unrecoverable if
it fails to start streaming</li>
<li>decklinkvideosrc gets into unrecoverable state if device is
busy</li>
<li>dwrite: Fix D3D12 critical warning</li>
<li>hlsdemux: Fix parsing of byterange and init map directives</li>
<li>mpegtsmux: Caps event fails with stream type change error</li>
<li>vulkanh24xdec: couple of fixes</li>
<li>vulkanh26xdec: fix discont state handling</li>
<li>waylandsink: add some error handler for event dispatch</li>
<li>zbar: tests: Handle symbol-bytes as not null-terminated</li>
<li>
<p>Monorepo: avtp, codec2json, iqa, microdns, openjpeg, qroverlay,
soundtouch, tinyalsa plugins require explicit enablement now
for a build using the Meson subproject fallback</p>
</li>
<li>
<p>Update to version 1.26.5:</p>
</li>
<li>
<p>av1parse: Don't error out on "currently" undefined seq-level
indices</p>
</li>
<li>av1parse: fails to parse AV1 bitstreams generated by FFmpeg
using the av1_nvenc hardware encoder</li>
<li>d3d12screencapturedevice: Avoid false device removal on monitor
reconfiguration</li>
<li>d3d12screencapturesrc: Fix OS handle leaks/random crash in WGC
mode</li>
<li>meson: d3d12: Add support for MinGW DirectXMath package</li>
<li>va: Re-negotiate after FLUSH</li>
<li>vaXXXenc: calculate latency with corrected framerate</li>
<li>vaXXXenc: fix potential race condition</li>
<li>vkphysicaldevice: enable sampler ycbcr conversion,
synchronization2 and timeline semaphore features</li>
<li>vulkan: ycbcr conversion extension got promoted in 1.1.0</li>
<li>
<p>wasapi2: Port to IMMDevice based device selection</p>
</li>
<li>
<p>Fix really disabling faad when building without faad support.</p>
</li>
<li>
<p>Do not build with faad in SLE16 where faad2 is not available.</p>
</li>
<li>
<p>Update to version 1.26.4:</p>
</li>
<li>
<p>avtp: crf: Setup socket during state change to ensure we handle
failure</p>
</li>
<li>d3d12screencapture: Add support for monitor add/remove in
device provider</li>
<li>mpegtsmux: fix double free caused by shared PMT descriptor</li>
<li>openh264: Ensure src_pic is initialized before use</li>
<li>rtmp2src: various fixes to make it play back AWS medialive
streams</li>
<li>ssdobjectdetector: Use correct tensor data index for the scores</li>
<li>v4l2codecs: h265dec: Fix zero-copy of cropped window located at
position 0,0</li>
<li>vp9parse: Fix handling of spatial SVC decoding</li>
<li>vp9parse: Revert "Always default to super-frame"</li>
<li>vtenc: Fix negotiation failure with profile=main-422-10</li>
<li>vulkan: Fix drawing too many triangles in fullscreenquad</li>
<li>vulkanfullscreenquad: add locks for synchronisation</li>
<li>Fix various valgrind/test errors when GST_DEBUG is enabled</li>
<li>More valgrind and test fixes</li>
<li>
<p>Various ASAN fixes</p>
</li>
<li>
<p>Provide and Obsolete gstreamer-1.20-plugin-openh264 too, not just
gstreamer-plugin-openh264.</p>
</li>
<li>
<p>Update to version 1.26.3:</p>
</li>
<li>
<p>amc: Overhaul hw-accelerated video codecs detection</p>
</li>
<li>bayer2rgb: Fix RGB stride calculation</li>
<li>d3d12compositor: Fix critical warnings</li>
<li>dashsink: Fix failing test</li>
<li>decklink: calculate internal using values closer to the current
clock times</li>
<li>decklinkvideosink: show preroll frame correctly</li>
<li>decklink: clock synchronization after pause</li>
<li>h266parser: Fix overflow when parsing subpic_level_info</li>
<li>lcevcdec: Check for errors after receiving all enhanced and
base pictures</li>
<li>meson: fix building -bad tests with disabled soundtouch</li>
<li>mpegts: handle MPEG2-TS with KLV metadata safely by preventing
out of bounds</li>
<li>mpegtsmux: Corrections around Teletext handling</li>
<li>srtsink: Fix header buffer filtering</li>
<li>transcoder: Fix uritranscodebin reference handling</li>
<li>tsdemux: Allow access unit parsing failures</li>
<li>tsdemux: Send new-segment before GAP</li>
<li>vulkanupload: fix regression for uploading VulkanBuffer</li>
<li>vulkanupload: fix regression when uploading to single memory
multiplaned memory images</li>
<li>webrtcbin: disconnect signal ICE handlers on dispose</li>
<li>{d3d12,d3d11}compositor: Fix negative position handling</li>
<li>
<p>{nv,d3d12,d3d11}decoder: Use interlace info in input caps</p>
</li>
<li>
<p>Build with noopenh264, move plugin to main package.</p>
</li>
<li>
<p>Drop conditionals for fdk-aac, explicitly build it for all
targets.</p>
</li>
<li>
<p>Move faad plugin to main package.</p>
</li>
</ul>
<p>Changes in gstreamer-docs:</p>
<ul>
<li>Update to version 1.26.7:</li>
<li>No changes, stable bump only.</li>
<li>Update docs.</li>
</ul>
<p>Changes in gstreamer-devtools:</p>
<ul>
<li>
<p>Update to version 1.26.7:</p>
</li>
<li>
<p>Fix issues with G_DISABLE_CHECKS & G_DISABLE_ASSERT</p>
</li>
<li>
<p>Update to version 1.26.6:</p>
</li>
<li>
<p>validate: http-actions: Replace GUri with GstURI for GLib 2.64
compatibility</p>
</li>
<li>
<p>Fix memory leak and use of incorrect context</p>
</li>
<li>
<p>Update to version 1.26.5:</p>
</li>
<li>
<p>No changes, stable bump only.</p>
</li>
<li>
<p>Update vendored dependencies (boo#1248053, CVE-2025-55159).</p>
</li>
<li>
<p>Update to version 1.26.4:</p>
</li>
<li>
<p>Update various Rust dependencies</p>
</li>
<li>
<p>Update to version 1.26.3:</p>
</li>
<li>
<p>validate: More memory leaks</p>
</li>
<li>validate: Valgrind fixes</li>
</ul>
<p>Changes in gstreamer:</p>
<ul>
<li>
<p>Update to version 1.26.7:</p>
</li>
<li>
<p>Highlighted bugfixes in 1.26.7:</p>
<ul>
<li>cea608overlay: improve handling of non-system memory</li>
<li>cuda: Fix runtime kernel compile with CUDA 13.0</li>
<li>d3d12: Fix crop meta support in converter and passthrough
handling in deinterlacer</li>
<li>fallbacksrc: source handling improvements; no-more-pads
signal for streams-unaware parents</li>
<li>inter: add properties to fine tune the inner elements</li>
<li>qtdemux: surround sound channel layout handling fixes and
performance improvements for GoPro videos</li>
<li>rtp: Add linear audio (L8, L16, L24) RTP payloaders /
depayloaders</li>
<li>rtspsrc: Send RTSP keepalives in TCP/interleaved modes</li>
<li>rtpamrpay2: frame quality indicator flag related fixes</li>
<li>rtpbasepay2: reuse last PTS when possible, to work around
problems with NVIDIA Jetson AV1 encoder</li>
<li>mpegtsmux, tsdemux: Opus audio handling fixes</li>
<li>threadshare: latency related improvements and many other
fixes</li>
<li>matroskamux, tsmux, flvmux, cea608mux: Best pad determination
fixes at EOS</li>
<li>unixfd: support buffers with a big payload</li>
<li>videorate unknown buffer duration assertion failure with
variable framerates</li>
<li>editing services: Make GESTimeline respect
SELECT_ELEMENT_TRACK signal discard decision; memory leak
fixes</li>
<li>gobject-introspection annotation fixes</li>
<li>cerbero: Update meson to 1.9.0 to enable Xcode 26
compatibility</li>
<li>Various bug fixes, build fixes, memory leak fixes, and other
stability and reliability improvements</li>
</ul>
</li>
<li>
<p>gstreamer:</p>
<ul>
<li>controller: Fix get_all() return type annotation</li>
<li>gst-launch: Do not assume error messages have a src element</li>
<li>multiqueue: Fix object reference handling in signal callbacks</li>
<li>netclientclock: Fix memory leak in error paths</li>
</ul>
</li>
<li>
<p>Update to version 1.26.6:</p>
</li>
<li>
<p>Highlighted bugfixes in 1.26.6:</p>
<ul>
<li>analytics GstTensorMeta handling changes (see note below)</li>
<li>closed caption combiner and transcriberbin stability fixes</li>
<li>decklinkvideosrc: fix unrecoverable state after failing to
start streaming because device is busy</li>
<li>decodebin3 tag handling improvements</li>
<li>fallbacksrc: Fix sources only being restarted once, as well
as some deadlocks and race conditions on shutdown</li>
<li>gtk4paintablesink: Try importing dmabufs withouth DMA_DRM
caps</li>
<li>hlsdemux2: Fix parsing of byterange and init map directives</li>
<li>rtpmp4gdepay2: allow only constantduration with neither
constantsize nor sizelength set</li>
<li>spotifysrc: update to librespot 0.7 to make work after recent
Spotify changes</li>
<li>threadshare: new blocking adapter element for use in front of
block elements such as sinks that sync to the clock</li>
<li>threadshare: various other threadshare element fixes and
improvements</li>
<li>v4l2: Add support for WVC1 and WMV3</li>
<li>videorate: possible performance improvements when operating
in drop-only mode</li>
<li>GstBaseParse fixes</li>
<li>Vulkan video decoder fixes</li>
<li>Fix gst-device-monitor-1.0 tool device-path regression on
Windows</li>
<li>Monorepo development environment builds fewer plugins using
subprojects by default, those require explicit enablement now</li>
<li>Python bindings: Handle buffer PTS, DTS, duration, offset,
and offset-end as unsigned long long (regression fix)</li>
<li>Cerbero: Reduce recipe parallelism in various cases and dump
cerbero and recipe versions into datadir during packaging</li>
<li>Various bug fixes, build fixes, memory leak fixes, and other
stability and reliability improvements</li>
</ul>
</li>
<li>
<p>Possibly breaking behavioural changes:</p>
<ul>
<li>Previously it was guaranteed that there is only ever up to
one GstTensorMeta per buffer. This is no longer true and code
working with GstTensorMeta must be able to handle multiple
GstTensorMeta now.</li>
</ul>
</li>
<li>
<p>gstreamer:</p>
<ul>
<li>baseparse: Try harder to fixate caps based on upstream in
default negotiation</li>
<li>gst-discoverer reports 1x1 dimensions for "valid" MP4 files</li>
<li>baseparse: don't clear most sticky events after a FLUSH_STOP
event</li>
<li>gstreamer: Disable miniobject inline functions for
gobject-introspection for non-subprojects too</li>
<li>gstreamer: Make sure to zero-initialize the GValue before
G_VALUE_COLLECT_INIT</li>
<li>ptp: Fix a new Rust 1.89 compiler warning on Windows</li>
<li>ptp: Fix new compiler warning with Rust 1.89</li>
<li>Segmentation fault when compiled with
"-ftrivial-auto-var-init=pattern". Use of unitialized GValue</li>
</ul>
</li>
<li>
<p>Update to version 1.26.5:</p>
</li>
<li>
<p>Highlighted bugfixes:</p>
<ul>
<li>audioconvert: Fix caps negotiation regression when using a
mix matrix</li>
<li>cea608overlay, cea708overlay: Accept GPU memory buffers if
downstream supports the overlay composition meta</li>
<li>d3d12screencapture source element and device provider fixes</li>
<li>decodebin3: Don't error on an incoming ONVIF metadata stream</li>
<li>uridecodebin3: Fix potential crash when adding URIs to
messages, e.g. if no decoder is available</li>
<li>v4l2: Fix memory leak for dynamic resolution change</li>
<li>VA encoder fixes</li>
<li>videorate, imagefreeze: Add support for JPEG XS</li>
<li>Vulkan integration fixes</li>
<li>wasapi2 audio device monitor improvements</li>
<li>threadshare: Many improvements and fixes to the generic
threadshare and RTP threadshare elements</li>
<li>rtpbin2 improvements and fixes</li>
<li>gst-device-monitor-1.0 command line tool improvements</li>
<li>Various bug fixes, build fixes, memory leak fixes, and other
stability and reliability improvements</li>
</ul>
</li>
<li>
<p>gstreamer:</p>
<ul>
<li>aggregator: add sub_latency_min to pad queue size</li>
<li>build: Disable C5287 warning on MSVC</li>
</ul>
</li>
<li>
<p>Update to version 1.26.4:</p>
</li>
<li>
<p>Highlighted bugfixes in 1.26.4:</p>
<ul>
<li>adaptivedemux2: Fixed reverse playback</li>
<li>d3d12screencapture: Add support for monitor add/remove in
device provider</li>
<li>rtmp2src: various fixes to make it play back AWS medialive
streams</li>
<li>rtph265pay: add profile-id, tier-flag, and level-id to output
rtp caps</li>
<li>vp9parse: Fix handling of spatial SVC decoding</li>
<li>vtenc: Fix negotiation failure with profile=main-422-10</li>
<li>gtk4paintablesink: Add YCbCr memory texture formats and other
improvements</li>
<li>livekit: add room-timeout</li>
<li>mp4mux: add TAI timestamp muxing support</li>
<li>rtpbin2: fix various race conditions, plus other bug fixes
and performance improvements</li>
<li>threadshare: add a ts-rtpdtmfsrc element, implement run-time
input switching in ts-intersrc</li>
<li>webrtcsink: fix deadlock on error setting remote description
and other fixes.</li>
<li>cerbero: WiX installer: fix missing props files in the MSI
packages</li>
<li>smaller macOS/iOS package sizes</li>
<li>Various bug fixes, build fixes, memory leak fixes, and other
stability and reliability improvements</li>
</ul>
</li>
<li>
<p>gstreamer:</p>
<ul>
<li>tracers: Fix deadlock in latency tracer</li>
<li>Fix various valgrind/test errors when GST_DEBUG is enabled</li>
<li>More valgrind and test fixes</li>
<li>Various ASAN fixes</li>
</ul>
</li>
<li>
<p>Update to version 1.26.3:</p>
</li>
<li>
<p>Highlighted bugfixes in 1.26.3:</p>
<ul>
<li>Security fix for the H.266 video parser</li>
<li>Fix regression for WAV files with acid chunks</li>
<li>Fix high memory consumption caused by a text handling
regression in uridecodebin3 and playbin3</li>
<li>Fix panic on late GOP in fragmented MP4 muxer</li>
<li>Closed caption conversion, rendering and muxing improvements</li>
<li>Decklink video sink preroll frame rendering and clock drift
handling fixes</li>
<li>MPEG-TS demuxing and muxing fixes</li>
<li>MP4 muxer fixes for creating very large files with faststart
support</li>
<li>New thread-sharing 1:N inter source and sink elements, and a
ts-rtpdtmfsrc</li>
<li>New speech synthesis element around ElevenLabs API</li>
<li>RTP H.265 depayloader fixes and improvements, as well as TWCC
and GCC congestion control fixes</li>
<li>Seeking improvements in DASH client for streams with gaps</li>
<li>WebRTC sink and source fixes and enhancements, including to
LiveKit and WHIP signallers</li>
<li>The macOS osxvideosink now posts navigation messages</li>
<li>QtQML6GL video sink input event handling improvements</li>
<li>Overhaul detection of hardware-accelerated video codecs on
Android</li>
<li>Video4Linux capture source fixes and support for BT.2100 PQ
and 1:4:5:3 colorimetry</li>
<li>Vulkan buffer upload and memory handling regression fixes</li>
<li>gst-python: fix various regressions introduced in 1.26.2</li>
<li>cerbero: fix text relocation issues on 32-bit Android and fix
broken VisualStudio VC templates</li>
<li>packages: ship pbtypes plugin and update openssl to 3.5.0 LTS</li>
<li>Various bug fixes, build fixes, memory leak fixes, and other
stability and reliability improvements</li>
</ul>
</li>
<li>
<p>gstreamer:</p>
<ul>
<li>aggregator: Do not set event seqnum to INVALID</li>
<li>baseparse: test: Fix race on test start</li>
<li>pad: Only remove TAG events on STREAM_START if the stream-id
actually changes</li>
<li>utils: Mark times array as static to avoid symbol conflict
with the POSIX function</li>
<li>vecdeque: Use correct index type gst_vec_deque_drop_struct()</li>
</ul>
</li>
</ul>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
SUSE Linux Micro 6.2
<br/>
<code>zypper in -t patch SUSE-SL-Micro-6.2-362=1</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
SUSE Linux Micro 6.2 (aarch64 ppc64le s390x x86_64)
<ul>
<li>libgstaudio-1_0-0-1.26.7-160000.1.1</li>
<li>libgstapp-1_0-0-1.26.7-160000.1.1</li>
<li>libgsttag-1_0-0-1.26.7-160000.1.1</li>
<li>gstreamer-debuginfo-1.26.7-160000.1.1</li>
<li>gstreamer-plugins-base-debugsource-1.26.7-160000.1.1</li>
<li>libgstriff-1_0-0-debuginfo-1.26.7-160000.1.1</li>
<li>libgstriff-1_0-0-1.26.7-160000.1.1</li>
<li>gstreamer-1.26.7-160000.1.1</li>
<li>libgstapp-1_0-0-debuginfo-1.26.7-160000.1.1</li>
<li>libgstpbutils-1_0-0-debuginfo-1.26.7-160000.1.1</li>
<li>libgstallocators-1_0-0-debuginfo-1.26.7-160000.1.1</li>
<li>libgstreamer-1_0-0-debuginfo-1.26.7-160000.1.1</li>
<li>libgstvideo-1_0-0-debuginfo-1.26.7-160000.1.1</li>
<li>libgstallocators-1_0-0-1.26.7-160000.1.1</li>
<li>gstreamer-plugins-base-1.26.7-160000.1.1</li>
<li>libgstgl-1_0-0-debuginfo-1.26.7-160000.1.1</li>
<li>libgstgl-1_0-0-1.26.7-160000.1.1</li>
<li>libgsttag-1_0-0-debuginfo-1.26.7-160000.1.1</li>
<li>libgstpbutils-1_0-0-1.26.7-160000.1.1</li>
<li>libgstvideo-1_0-0-1.26.7-160000.1.1</li>
<li>gstreamer-plugins-base-debuginfo-1.26.7-160000.1.1</li>
<li>libgstaudio-1_0-0-debuginfo-1.26.7-160000.1.1</li>
<li>libgstreamer-1_0-0-1.26.7-160000.1.1</li>
<li>gstreamer-debugsource-1.26.7-160000.1.1</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-55159.html">https://www.suse.com/security/cve/CVE-2025-55159.html</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1237097">https://bugzilla.suse.com/show_bug.cgi?id=1237097</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1248053">https://bugzilla.suse.com/show_bug.cgi?id=1248053</a>
</li>
</ul>
</div>