GStreamer, a media streaming framework with a plugin-based architecture, has multiple security flaws in its plugins. CVE-2026-3085 and CVE-2026-3083 describe remote code execution vulnerabilities caused by heap-based buffer overflow and out-of-bounds write in the rtpqdm2depay plugin. CVE-2026-2921 involves arbitrary code execution through an integer overflow in the RIFF palette processing during AVI file handling. These vulnerabilities could allow an attacker to execute arbitrary code on affected systems. Red Hat has released security updates for the affected packages in Red Hat Enterprise Linux 7 Extended Lifecycle Support to remediate these issues.

Successful exploitation of these vulnerabilities could lead to remote or arbitrary code execution on affected systems running vulnerable versions of GStreamer plugins. This could compromise system integrity and allow attackers to execute malicious code with the privileges of the affected application. The advisory rates the security impact as Important (high severity). There are no known exploits in the wild at the time of the advisory.

Red Hat has released security updates for gstreamer-plugins-base and gstreamer-plugins-good packages for Red Hat Enterprise Linux 7 Extended Lifecycle Support to address these vulnerabilities. Users should apply the updates as described in the Red Hat advisory RHSA-2026:7850 and the referenced article https://access.redhat.com/articles/11258. Patch status is confirmed with official fixes available. No additional mitigation steps are indicated beyond applying the vendor-provided updates.