This advisory covers seven distinct vulnerabilities in the GStreamer media framework and its plugins, which allow arbitrary or remote code execution through multiple memory corruption issues including heap-based buffer overflows, integer overflows, and out-of-bounds writes. The affected components process various media formats such as ASF, JPEG, AVI, RealMedia, RTP, and DVB subtitles. The vulnerabilities are tracked under CVE-2026-2920, CVE-2026-2921, CVE-2026-2922, CVE-2026-2923, CVE-2026-3082, CVE-2026-3083, and CVE-2026-3085. Red Hat has released updated packages for Red Hat Enterprise Linux 10 and related variants to remediate these issues.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code remotely on affected systems by crafting malicious media files that trigger heap-based buffer overflows, integer overflows, or out-of-bounds writes in the GStreamer plugins. This could lead to full system compromise or denial of service. The advisory rates the security impact as Important (high severity). There are no known exploits in the wild at the time of the advisory.

Red Hat has released updated packages for the affected GStreamer plugins in Red Hat Enterprise Linux 10 and its variants. Users should apply these official security updates as soon as possible to remediate the vulnerabilities. For detailed instructions on applying the update, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.