This security update addresses several remote code execution vulnerabilities in the GStreamer multimedia framework's gstreamer-plugins-ugly package. Notably, CVE-2026-2920 involves a heap-based buffer overflow in the ASF demuxer, and CVE-2026-2922 involves an out-of-bounds write in the RealMedia demuxer. Additional vulnerabilities fixed include heap-based buffer overflows and out-of-bounds writes in other GStreamer components such as JPEG parser, rtpqdm2depay, AVI file handling, and DVB subtitles. These flaws could allow an attacker to execute arbitrary code by processing specially crafted media files. The Red Hat advisory confirms the availability of security updates for Red Hat Enterprise Linux 10 and related architectures.

Successful exploitation of these vulnerabilities could allow remote attackers to execute arbitrary code on affected systems by processing malicious media files. This could lead to full system compromise depending on the privileges of the affected application. The vulnerabilities affect multiple GStreamer plugins used in media processing, increasing the attack surface for applications relying on these components.

Red Hat has released official security updates that address these vulnerabilities in Red Hat Enterprise Linux 10 and related packages. Users should apply these updates promptly to remediate the issues. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. There are no indications that these vulnerabilities are currently exploited in the wild.