The gstreamer1 packages, which provide a streaming media framework based on filter graphs operating on media data, contain two security vulnerabilities: an integer overflow during EXIF metadata parsing (CVE-2024-4453) and a stack-based buffer overflow in AV1 video parsing (CVE-2024-0444). Both vulnerabilities have been rated as moderate severity by Red Hat Product Security. The issues affect Red Hat Enterprise Linux 9 (including various extended update support and architecture variants) and Red Hat In-Vehicle Operating System Core 1. Red Hat has released updated packages to remediate these vulnerabilities as detailed in advisories RHSA-2025:7178 and RHSA-2025:18416.

Successful exploitation of these vulnerabilities could lead to memory corruption issues such as buffer overflow or integer overflow within the gstreamer1 media processing framework. This could potentially result in denial of service or other unintended behavior in applications using these libraries. The impact is rated moderate by the vendor. There are no known exploits in the wild at this time.

Red Hat has released security updates for gstreamer1, gstreamer1-plugins-bad-free, gstreamer1-plugins-ugly-free, and gstreamer1-rtsp-server packages that address these vulnerabilities. Users should apply the updates provided for Red Hat Enterprise Linux 9 (versions >=9.0.0 <9.6.0 and >=9.6.0 <=9.8.0) and Red Hat In-Vehicle Operating System Core 1 as soon as possible. Detailed update instructions are available from Red Hat's official advisory and support channels. No additional mitigation is required beyond applying the official patches.