This advisory covers four distinct vulnerabilities in GStreamer components: CVE-2026-3082 (heap-based buffer overflow in JPEG parser), CVE-2026-3085 (heap-based buffer overflow in rtpqdm2depay), CVE-2026-2921 (RIFF palette integer overflow in AVI file handling), and CVE-2026-3083 (out-of-bounds write in rtpqdm2depay). These vulnerabilities can allow remote attackers to execute arbitrary code by processing specially crafted media files. The issues are addressed in updated packages provided by Red Hat for multiple architectures and variants of Red Hat Enterprise Linux 9.4.

Successful exploitation of these vulnerabilities could allow remote code execution on affected systems, potentially leading to full system compromise. The vulnerabilities arise from memory corruption issues such as heap-based buffer overflows and integer overflows in media parsing components. No known exploits in the wild have been reported at the time of this advisory.

Red Hat has released updated packages for gstreamer1-plugins-bad-free, gstreamer1-plugins-base, and gstreamer1-plugins-good to address these vulnerabilities. Users should apply the security updates for Red Hat Enterprise Linux 9.4 Extended Update Support and related variants as detailed in Red Hat advisory RHSA-2026:8857. For update instructions, refer to https://access.redhat.com/articles/11258. Patch status is confirmed with official fixes available.