SB2026080690 - Red Hat Enterprise Linux 10 update for gstreamer1-plugins-ugly-free

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080690

SB2026080690 - Red Hat Enterprise Linux 10 update for gstreamer1-plugins-ugly-free

Published: August 6, 2026

Security Bulletin ID SB2026080690
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Out-of-bounds read (CVE-ID: CVE-2026-53703)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the rmdemux and rademux demuxers when parsing malformed RealMedia files. A remote attacker can provide a crafted RealMedia file to disclose sensitive information.

The issue occurs while parsing file headers, stream properties, and audio packets.


2) Integer overflow (CVE-ID: CVE-2026-53704)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow in the rmdemux and rademux demuxers when parsing malformed RealMedia files. A remote attacker can provide a crafted RealMedia file to cause a denial of service.

The issue stems from the use of signed integer types for size and length parameters during size calculations and index operations.


Remediation

Install update from vendor's website.

References