Red Hat Product Security has published an important security advisory (RHSA-2026:8854) for multiple GStreamer plugin packages in Red Hat Enterprise Linux 10.0 Extended Update Support. The advisory addresses seven vulnerabilities (CVE-2026-2920, CVE-2026-2921, CVE-2026-2922, CVE-2026-2923, CVE-2026-3082, CVE-2026-3083, CVE-2026-3085) that allow arbitrary or remote code execution via heap-based buffer overflows, integer overflows, and out-of-bounds writes in various media file processing components. Affected components include ASF file processing, JPEG parser, RTP depayloader, AVI file handling, RealMedia demuxer, and DVB subtitles handling. The advisory provides updated packages for multiple architectures and product variants, including x86_64, s390x, ppc64le, and aarch64. The vendor has released patches and recommends applying the updates as detailed in their advisory. No known exploits in the wild have been reported at this time.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code remotely on affected systems by processing specially crafted media files. This could lead to full compromise of the affected system. The vulnerabilities affect multiple GStreamer plugins responsible for handling various media formats, increasing the attack surface. The severity is rated high by Red Hat Product Security. No known exploits in the wild have been reported yet.

Red Hat has released updated packages for gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free as part of Red Hat Enterprise Linux 10.0 Extended Update Support. Users should apply these official patches promptly following the instructions in the Red Hat advisory RHSA-2026:8854 (https://access.redhat.com/errata/RHSA-2026:8854). No alternative mitigations or workarounds are specified. Patch status is confirmed; applying the vendor-provided updates is the recommended remediation.