This advisory covers seven distinct vulnerabilities in GStreamer and its plugins that allow arbitrary or remote code execution through memory corruption issues like heap-based buffer overflows, integer overflows, and out-of-bounds writes. The affected components process various media formats including ASF, JPEG, AVI, RealMedia, RTP, and DVB subtitles. The vulnerabilities are identified by CVE-2026-2920, CVE-2026-2921, CVE-2026-2922, CVE-2026-2923, CVE-2026-3082, CVE-2026-3083, and CVE-2026-3085. Red Hat has released updated packages for Red Hat Enterprise Linux 9.6 Extended Update Support to remediate these issues.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code remotely on affected systems by crafting malicious media files. This could lead to full system compromise or unauthorized control over the affected host. The vulnerabilities affect critical components of the media processing pipeline, increasing the risk of exploitation when processing untrusted media content.

Red Hat has published updated packages for gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free as part of Red Hat Enterprise Linux 9.6 Extended Update Support. Users should apply these official updates promptly to remediate the vulnerabilities. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No alternative mitigations or workarounds are specified in the advisory.