This vulnerability exists in GStreamer's RealMedia demuxer within the gst-plugins-ugly package. The demuxer improperly parses variable-name and variable-value pairs from a specially crafted FILEINFO metadata section using re_skip_pascal_string() without validating buffer boundaries. Additionally, the element count controlling the parsing loop is attacker-controlled and unchecked, which can cause an infinite loop. These flaws can lead to out-of-bounds reads, causing crashes, hangs, or limited information disclosure. No code execution or memory corruption has been identified. The issue affects Red Hat Enterprise Linux 9 versions prior to 9.8.1. Red Hat has released a security update to fix this vulnerability.

An attacker can cause denial of service by crashing or hanging applications that process malicious RealMedia files due to out-of-bounds reads and infinite loops. There is also potential for limited information disclosure from adjacent memory reads. No privilege escalation, code execution, or memory corruption has been reported. The impact is limited by the legacy nature and limited real-world usage of the RealMedia format.

Red Hat has released an official security update for gstreamer1-plugins-ugly-free to address this vulnerability. Users should apply the update as described in the Red Hat advisory (RHSA-2026:36674). No effective workaround or mitigation other than patching is currently available or meets Red Hat's criteria for deployment and stability. Upgrading to Red Hat Enterprise Linux 9.8.1 or later versions where the fix is included is recommended.