The gstreamer1-plugins-bad-free package for GStreamer contains four security vulnerabilities: CVE-2026-52718 is a denial of service caused by byte/bit confusion in the AV1 tile_list_obu parser; CVE-2026-52719 is an out-of-bounds read via JPEG segment length validation in the VA decoder; CVE-2026-52720 is a heap buffer overflow triggered by a crafted VNC server rectangle in librfb; and CVE-2026-52722 is a signed integer overflow in the VMnc decoder cursor payload handling. These issues affect Red Hat Enterprise Linux 10 and related variants. Red Hat has released updated packages to address these vulnerabilities as detailed in advisory RHSA-2026:36749.

Successful exploitation of these vulnerabilities could lead to denial of service conditions, out-of-bounds memory reads, or heap buffer overflows, potentially causing application crashes or memory corruption when processing specially crafted media data. The advisory rates the overall security impact as Important (high severity). There are no known exploits in the wild at this time.

Red Hat has released updated gstreamer1-plugins-bad-free packages for Red Hat Enterprise Linux 10 and related variants that fix these vulnerabilities. Users should apply the security update described in advisory RHSA-2026:36749 promptly. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor.