The vulnerability exists in the GStreamer RealMedia demuxer component of gst-plugins-ugly, where the parser reads fields from MDPR chunks of RealMedia files without sufficient bounds checking. Specifically, for audio stream header versions 4 and 5, the parser reads codec type, packet size, sample rate, channel count, and extra codec data length from fixed offsets without verifying that the chunk contains enough data. Maliciously crafted RealMedia files with undersized MDPR chunks can trigger out-of-bounds reads, leading to application crashes and possible limited information disclosure. This affects Red Hat Enterprise Linux 10 versions 10 and 10.2. Red Hat has issued patches in gstreamer1-plugins-ugly-free package to fix this issue.

Successful exploitation can cause application crashes (denial of service) and may lead to limited information disclosure by incorporating bytes read beyond buffer boundaries into stream metadata. The CVSS 3.1 base score is 7.1 (High), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, low confidentiality impact, no integrity impact, and high availability impact.

Red Hat has released official security updates for the gstreamer1-plugins-ugly-free package that address this vulnerability. Users of Red Hat Enterprise Linux 10 (versions 10 and 10.2) should apply the updates as described in Red Hat advisory RHSA-2026:36673 and the referenced article https://access.redhat.com/articles/11258. Applying these updates mitigates the vulnerability. No additional mitigation steps are required beyond applying the official patches.