CVE-2026-121626

EUVD-2026-116101
GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in H46024Socket::ReceivedProbePacket() that allows remote attackers to cause a heap over-read by sending short probe packets. Attackers can send a short application-defined RTCP packet to the media port during H.460.24 probing to read past the heap allocation and possibly crash the gatekeeper.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.7 LOW
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/willamowius/gnugk
https://github.com/willamowius/gnugk/blob/v5_15/GkClient.cxx#L963-L990
https://github.com/willamowius/gnugk/commit/160aa27344ecc9a443cccaa63e8d7fa95a766610
https://github.com/willamowius/gnugk/releases/tag/v5_16
https://www.vulncheck.com/advisories/gnu-gatekeeper-before-5.16-out-of-bounds-read-in-h-460.24-rtcp-probe-handler