This advisory addresses seven distinct security vulnerabilities in the GStreamer multimedia framework's plugin packages. The issues include arbitrary code execution and remote code execution caused by heap-based buffer overflows, integer overflows, and out-of-bounds memory writes in components handling ASF files (CVE-2026-2920), JPEG parsing (CVE-2026-3082), RTP QDM2 depayloader (CVE-2026-3085 and CVE-2026-3083), AVI file handling (CVE-2026-2921), RealMedia demuxer (CVE-2026-2922), and DVB subtitles processing (CVE-2026-2923). These vulnerabilities could allow an attacker to execute arbitrary code remotely by crafting malicious media files. Red Hat has released updated packages for multiple architectures and product variants within Red Hat Enterprise Linux 10.0 Extended Update Support to remediate these issues.

Successful exploitation of these vulnerabilities could allow remote attackers to execute arbitrary code on affected systems by processing specially crafted media files. This could lead to system compromise, unauthorized access, or disruption of service. The advisory rates the security impact as Important (high severity). There are no known exploits in the wild at the time of the advisory.

Red Hat has released updated packages for the affected GStreamer plugin packages as part of Red Hat Enterprise Linux 10.0 Extended Update Support. Users should apply these official updates promptly to remediate the vulnerabilities. For detailed instructions on applying the updates, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No alternative mitigations or workarounds are specified in the advisory.