The vulnerability CVE-2026-53704 affects the RealMedia demuxer in GStreamer's gst-plugins-ugly package on Red Hat Enterprise Linux 9. When processing a specially crafted RealMedia file, the demuxer uses the function re_skip_pascal_string() to parse variable-name and variable-value pairs without validating that the offsets remain within the mapped buffer, leading to an out-of-bounds read. Furthermore, the element count controlling the parsing loop is read from attacker-controlled data without validation, which can cause an infinite loop. This flaw can cause the application to crash, hang indefinitely, or potentially read limited adjacent memory contents. The vulnerability has a CVSS 3.1 base score of 7.1 (high severity) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, limited confidentiality impact, no integrity impact, and high availability impact. The issue affects Red Hat Enterprise Linux 9 versions from 9 up to but excluding 9.8.1. Red Hat has released a security update (gstreamer1-plugins-ugly-free-1.22.12-6.el9_8.1) that addresses this vulnerability. The vendor rates the update's security impact as Moderate and provides detailed advisories and update instructions.

An attacker can craft a malicious RealMedia file that triggers out-of-bounds reads and an infinite loop in the vulnerable GStreamer RealMedia demuxer. This can cause the affected application to crash or hang, resulting in denial of service. There is also potential for limited adjacent memory disclosure due to the out-of-bounds read. The vulnerability does not impact data integrity but can affect availability and confidentiality to a limited extent. No known exploits are reported in the wild at this time.

Red Hat has released an updated package gstreamer1-plugins-ugly-free-1.22.12-6.el9_8.1 that fixes this vulnerability. Users of Red Hat Enterprise Linux 9 versions >=9 and <9.8.1 should apply this security update promptly. For update instructions, refer to Red Hat's official article at https://access.redhat.com/articles/11258. No additional mitigations are indicated by the vendor advisory. Systems updated to Red Hat Enterprise Linux 9.8.1 or later are not affected.