This advisory covers seven distinct vulnerabilities in GStreamer plugins affecting Red Hat Enterprise Linux 9. The issues include arbitrary code execution via ASF file processing (CVE-2026-2920), remote code execution via heap-based buffer overflow in JPEG parser (CVE-2026-3082), heap-based buffer overflow in rtpqdm2depay (CVE-2026-3085), arbitrary code execution via RIFF palette integer overflow in AVI handling (CVE-2026-2921), out-of-bounds write vulnerabilities in rtpqdm2depay (CVE-2026-3083), RealMedia demuxer (CVE-2026-2922), and DVB subtitles handling (CVE-2026-2923). These vulnerabilities could allow attackers to execute arbitrary code remotely by processing crafted media files. Red Hat has released updated packages to fix these issues.

Successful exploitation of these vulnerabilities could lead to arbitrary or remote code execution on affected systems, potentially allowing attackers to gain control or disrupt services. The vulnerabilities arise from memory corruption issues such as heap-based buffer overflows, integer overflows, and out-of-bounds writes in media file processing components of GStreamer plugins. This poses a significant security risk for systems processing untrusted media content.

Red Hat has released updated packages for gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free as part of Red Hat Enterprise Linux 9 updates to address these vulnerabilities. Users should apply the security updates as detailed in the Red Hat advisory RHSA-2026:6300 and the referenced article https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the official patches.