Threats affecting pkg:rpm/redhat/gstreamer1-plugins-ugly-free

An integer overflow/underflow vulnerability (CVE-2026-19389) exists in the asfdemux bounds checks of the gstreamer1-plugins-ugly-free package in the GStreamer streaming media framework. This flaw can lead to an out-of-bounds read. Red Hat has issued an important security update for Red Hat Enterprise Linux 10 to address this issue across multiple architectures including x86_64, ppc64le, and aarch64. The vulnerability is rated as high severity by the source, though no CVSS score is provided.

Multiple security vulnerabilities have been identified in GStreamer plugins included in Red Hat Enterprise Linux 10.0 Extended Update Support. These vulnerabilities include arbitrary code execution and remote code execution via heap-based buffer overflows, integer overflows, and out-of-bounds writes in various media file parsers and demuxers such as ASF, JPEG, AVI, RealMedia, RTP, and DVB subtitles. Red Hat has issued an important security advisory (RHSA-2026:8854) addressing these issues with updated packages. The vulnerabilities affect several GStreamer plugin packages: bad-free, base, good, and ugly-free. The advisory provides updated packages for multiple architectures and product variants. The severity is rated as high by the source. Patch availability is confirmed through the advisory with instructions for applying updates.