GStreamer, a streaming media framework, contains several critical security flaws in its plugins. Specifically, CVE-2026-3082 and CVE-2026-3085 describe remote code execution via heap-based buffer overflows in the JPEG parser and rtpqdm2depay plugin respectively. CVE-2026-2921 involves arbitrary code execution through a RIFF palette integer overflow in AVI file handling. CVE-2026-3083 details remote code execution via an out-of-bounds write in rtpqdm2depay. These vulnerabilities allow an attacker to execute arbitrary code remotely by processing crafted media files. The issues affect multiple GStreamer plugin packages distributed with Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat has released updated packages to remediate these vulnerabilities.

Successful exploitation of these vulnerabilities could allow remote attackers to execute arbitrary code on affected systems by processing specially crafted media files. This could lead to full system compromise or unauthorized control of the affected host. The vulnerabilities affect core multimedia processing components, increasing the risk for systems that handle untrusted media content.

Red Hat has issued updated packages for gstreamer1-plugins-bad-free, gstreamer1-plugins-base, and gstreamer1-plugins-good addressing these vulnerabilities. Users of Red Hat Enterprise Linux 7 Extended Lifecycle Support should apply the security updates as detailed in Red Hat Advisory RHSA-2026:7673. For update instructions, refer to https://access.redhat.com/articles/11258. Patch status is confirmed by the vendor advisory and these updates should be applied promptly to mitigate the risk.