The vulnerability exists in the GStreamer RealMedia demuxer (gst-plugins-ugly) used in Red Hat Enterprise Linux 10. When processing RealMedia files, the demuxer parses MDPR chunks to configure audio streams. For audio stream header versions 4 and 5, the parser reads fixed offsets within the chunk without verifying the chunk's size, leading to out-of-bounds reads if the chunk is too small. This can cause application crashes and may leak some memory content as stream metadata. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, limited confidentiality impact, no integrity impact, and high availability impact.

Successful exploitation can cause the affected application to crash due to out-of-bounds memory reads. Additionally, there is a potential for limited information disclosure where bytes read beyond the buffer boundary may be incorporated into stream metadata. There is no indication of integrity compromise. The vulnerability does not require privileges but does require user interaction (opening a crafted RealMedia file). No known exploits are reported in the wild.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-53703 for current remediation guidance. Until a fix is available, avoid opening untrusted RealMedia (.rm) files with affected GStreamer components. Monitor the vendor advisory for updates on patches or workarounds.