security update for gstreamer1-plugins-good

The gstreamer1-plugins-good package contains several remote code execution vulnerabilities: CVE-2026-18295 and CVE-2026-18296 involve heap-based buffer overflows during MRF file parsing; CVE-2026-18298 involves a heap-based buffer overflow in PNG file parsing; and CVE-2026-18299 involves a use-after-free in the rtpsbcdepay component. These vulnerabilities could allow an attacker to execute arbitrary code remotely. The issues affect multiple versions of the package across Red Hat Enterprise Linux 9 and SUSE distributions. Red Hat has issued an important security advisory with patches available to remediate these vulnerabilities.

Successful exploitation of these vulnerabilities could allow remote attackers to execute arbitrary code on affected systems via specially crafted media files. This could lead to full system compromise depending on the privileges of the affected process. The vulnerabilities affect core media processing components, increasing the risk in environments processing untrusted media streams.

A security update is available and should be applied promptly. Red Hat has released patches for affected versions of gstreamer1-plugins-good in Red Hat Enterprise Linux 9 and related variants. Users should follow the vendor's official guidance to update to fixed versions. No additional mitigation steps are indicated beyond applying the official patches.