This advisory addresses two security flaws in GStreamer plugins used in Red Hat Enterprise Linux 9. The first vulnerability (CVE-2026-19387) is a heap out-of-bounds write in the adpcmdec IMA/DVI ADPCM decoder within the gstreamer1-plugins-bad-free package. The second vulnerability (CVE-2026-19389) is an integer overflow/underflow in the asfdemux bounds checks causing an out-of-bounds read in the gstreamer1-plugins-ugly-free package. Both vulnerabilities could potentially lead to memory corruption. Red Hat has released updated packages to fix these issues. The advisory references Red Hat Enterprise Linux 9 and its Extended Update Support versions as affected products.

The heap out-of-bounds write and out-of-bounds read vulnerabilities could lead to memory corruption, which may cause application crashes or potentially allow attackers to execute arbitrary code or cause denial of service. Red Hat rates the security impact as Important, indicating a high severity but not explicitly critical. No known exploits in the wild have been reported at this time.

Red Hat has released updated packages for gstreamer1-plugins-bad-free and gstreamer1-plugins-ugly-free as part of Red Hat Enterprise Linux 9 updates. Users should apply these official updates promptly to remediate the vulnerabilities. Refer to Red Hat's official advisory RHSA-2026:55865 and the update instructions at https://access.redhat.com/articles/11258 for detailed remediation steps. No alternative mitigations are indicated or required beyond applying the vendor-provided patches.