This advisory covers four security vulnerabilities in GStreamer plugins affecting Red Hat Enterprise Linux 7 Extended Lifecycle Support. The issues include a heap-based buffer overflow in the JPEG parser (CVE-2026-3082), a heap-based buffer overflow and an out-of-bounds write in the rtpqdm2depay element (CVE-2026-3085 and CVE-2026-3083), and an integer overflow in the RIFF palette handling in AVI file processing (CVE-2026-2921). These vulnerabilities allow remote or arbitrary code execution by processing specially crafted media files. Red Hat has released updated packages to fix these vulnerabilities as detailed in advisory RHSA-2026:7673.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code remotely on affected systems by supplying malicious media content. This could lead to system compromise or unauthorized control over the affected host. The advisory rates the security impact as Important (high severity). There are no known exploits in the wild at the time of the advisory.

Red Hat has released updated packages for gstreamer1-plugins-bad-free, gstreamer1-plugins-base, and gstreamer1-plugins-good to address these vulnerabilities. Users should apply the security update RHSA-2026:7673 promptly to remediate these issues. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.