CVE-2026-52719 is an out-of-bounds read vulnerability in the VA JPEG decoder component of GStreamer's gst-plugins-bad-free package on Red Hat Enterprise Linux 10. The JPEG parser reads a segment length value from the bitstream without proper validation against the available input data, which can cause downstream parsing to read beyond the input buffer boundaries. This flaw can be triggered remotely by enticing a user to open a maliciously crafted JPEG file, potentially resulting in application crashes or information disclosure. Red Hat has issued an important security advisory and released updated packages that fix this vulnerability in versions 10.2.4 and later.

The vulnerability allows a remote attacker to cause a denial of service via application crash or potentially disclose information by exploiting an out-of-bounds read in the JPEG parser. The CVSS 3.1 base score is 7.1 (high severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, low confidentiality impact, no integrity impact, and high availability impact. No known exploits in the wild have been reported at this time.

Red Hat has released an official security update for the gstreamer1-plugins-bad-free package that addresses this vulnerability. Users should apply the update to versions 10.2.4 or later as provided in Red Hat Advisory RHSA-2026:36749. Detailed update instructions are available at https://access.redhat.com/articles/11258. Applying this update fully mitigates the vulnerability. No additional workarounds or mitigations are indicated by the vendor.