CVE-2026-18299 is a use-after-free vulnerability in the rtpsbcdepay element of the GStreamer multimedia framework, specifically within the gstreamer1-plugins-good package. This flaw can lead to remote code execution. Red Hat has issued an important security advisory (RHSA-2026:59972) providing updates that fix this vulnerability for Red Hat Enterprise Linux 10 across various supported architectures including x86_64, s390x, ppc64le, and aarch64. The advisory references a patch that mitigates the use-after-free condition to prevent exploitation.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely on affected systems running vulnerable versions of gstreamer1-plugins-good. This could lead to system compromise or unauthorized control over the affected host. Red Hat rates the security impact as Important (high severity). There are no known exploits in the wild at the time of the advisory.

Red Hat has released updated packages for gstreamer1-plugins-good that address CVE-2026-18299. Users of Red Hat Enterprise Linux 10 and its variants should apply the security update as detailed in Red Hat advisory RHSA-2026:59972. The update is available through official Red Hat channels and includes fixes for all affected architectures. Applying this update is the recommended and official remediation. No additional mitigation steps are indicated by Red Hat.