The gstreamer1-plugins-bad-free package for GStreamer contains multiple vulnerabilities: CVE-2026-52718 is a denial of service caused by byte/bit confusion in the AV1 tile_list_obu parser; CVE-2026-52719 is an out-of-bounds read via JPEG segment length validation in the VA decoder; CVE-2026-52720 is a heap buffer overflow triggered by a crafted VNC server rectangle in librfb; and CVE-2026-52722 is a signed integer overflow in the VMnc decoder cursor payload handling. These vulnerabilities can lead to denial of service or memory corruption. Red Hat has released updated packages for Red Hat Enterprise Linux 9 and related variants to fix these issues as detailed in advisory RHSA-2026:36834.

Successful exploitation of these vulnerabilities can result in denial of service (application crash or hang) or potential memory corruption due to buffer overflows and integer overflows. The CVSS base score for CVE-2026-52718 is 6.5 (High), indicating a significant impact on availability without confidentiality or integrity loss. No known exploits in the wild have been reported at this time.

Red Hat has released security updates for the gstreamer1-plugins-bad-free package in Red Hat Enterprise Linux 9 and related distributions. Users should apply the updates provided in advisory RHSA-2026:36834 promptly to remediate these vulnerabilities. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigations are specified by the vendor beyond applying the official patches.