This advisory addresses multiple remote code execution and arbitrary code execution vulnerabilities in GStreamer 1.x plugin packages (gstreamer1-plugins-bad-free, base, good, and ugly-free) for Red Hat Enterprise Linux 10. The flaws include heap-based buffer overflows (CVE-2026-3082, CVE-2026-3085), integer overflow (CVE-2026-2921), and out-of-bounds writes (CVE-2026-3083, CVE-2026-2922, CVE-2026-2923) in various media parsers and demuxers such as ASF, JPEG, AVI, RTP, RealMedia, and DVB subtitles. These vulnerabilities could allow an attacker to execute arbitrary code remotely by processing specially crafted media files. Red Hat has released updated packages to fix these issues as detailed in advisory RHSA-2026:6259.

Successful exploitation of these vulnerabilities could allow remote attackers to execute arbitrary code on affected systems by processing maliciously crafted media files. This could lead to system compromise or denial of service. The vulnerabilities affect multiple GStreamer plugins responsible for handling various media formats, increasing the attack surface. The severity is rated as high by Red Hat Product Security.

Red Hat has released updated packages for gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free for Red Hat Enterprise Linux 10 and related builder products. Users should apply these security updates promptly to remediate the vulnerabilities. For detailed update instructions, refer to the Red Hat advisory RHSA-2026:6259 and the linked article https://access.redhat.com/articles/11258. No alternative mitigations are specified; applying the official patches is the recommended remediation.