The gstreamer1-plugins-bad-free package in Red Hat Enterprise Linux 10 contains several security flaws: CVE-2026-52718 is a denial of service vulnerability caused by byte/bit confusion in the AV1 tile_list_obu parser; CVE-2026-52719 involves an out-of-bounds read due to improper JPEG segment length validation in the VA decoder; CVE-2026-52720 is a heap buffer overflow triggered by a crafted VNC server rectangle in librfb; and CVE-2026-52722 is a signed integer overflow in the VMnc decoder's cursor payload handling. These vulnerabilities have been addressed in updated package versions provided by Red Hat.

Successful exploitation of these vulnerabilities could lead to denial of service conditions, memory corruption, or crashes in applications using the affected GStreamer plugins. The issues affect media processing components, potentially impacting systems that handle streaming media or remote desktop protocols. No known exploits in the wild have been reported at this time.

Red Hat has issued an important security advisory (RHSA-2026:36749) with updated packages for gstreamer1-plugins-bad-free that fix these vulnerabilities. Users should apply the provided updates for Red Hat Enterprise Linux 10 and related CodeReady Linux Builder variants as detailed in the advisory at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patches.