This advisory covers six distinct vulnerabilities in the GStreamer multimedia framework plugins used in Red Hat Enterprise Linux 8. The vulnerabilities include arbitrary code execution via ASF file processing (CVE-2026-2920), remote code execution via heap-based buffer overflow in JPEG parser (CVE-2026-3082), remote code execution via heap-based buffer overflow and out-of-bounds write in rtpqdm2depay (CVE-2026-3085 and CVE-2026-3083), arbitrary code execution via RIFF palette integer overflow in AVI handling (CVE-2026-2921), and remote code execution via out-of-bounds write in DVB subtitles handling (CVE-2026-2923). These issues stem from memory corruption vulnerabilities such as buffer overflows and integer overflows in media processing components. Red Hat has released updated packages to remediate these vulnerabilities.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code remotely on affected systems by processing specially crafted media files. This could lead to full compromise of the system running vulnerable GStreamer plugins. The vulnerabilities affect core media processing components, increasing the risk of exploitation if unpatched.

Red Hat has released updated packages for gstreamer1-plugins-bad-free, gstreamer1-plugins-base, and gstreamer1-plugins-good for Red Hat Enterprise Linux 8 to address these vulnerabilities. Users should apply the security updates as detailed in Red Hat Advisory RHSA-2026:6750 and the referenced article https://access.redhat.com/articles/11258. No alternative mitigations or workarounds are specified. Patch status is confirmed by the vendor advisory.