This Red Hat security advisory addresses seven vulnerabilities in GStreamer plugin packages that could allow arbitrary or remote code execution. The flaws include heap-based buffer overflows (CVE-2026-3082, CVE-2026-3085), integer overflow (CVE-2026-2921), and out-of-bounds writes (CVE-2026-3083, CVE-2026-2922, CVE-2026-2923) in various media parsers and demuxers such as ASF, JPEG, AVI, RTP QDM2 depayloader, RealMedia Demuxer, and DVB subtitles handling. These vulnerabilities affect multiple GStreamer plugin packages distributed with Red Hat Enterprise Linux 9 and CodeReady Linux Builder. Red Hat has issued updated packages to remediate these issues as detailed in advisory RHSA-2026:19180.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code remotely or locally by processing specially crafted media files. This could lead to system compromise or denial of service. The vulnerabilities affect core media processing components in GStreamer plugins, which are widely used in multimedia applications on affected Red Hat Enterprise Linux 9 systems.

Red Hat has released security updates that fix these vulnerabilities in the gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free packages for Red Hat Enterprise Linux 9 and CodeReady Linux Builder. Users should apply these official updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.