CVE-2026-18649

EUVD-2026-53768

06.08.2026, 08:16

A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacker can send a continuous stream of RTP fragments without ever transmitting an end-of-fragment marker, causing the reassembly buffer to grow without bound until process memory is exhausted. This results in a denial of service through process termination.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 57.62%

Debian Releases

Debian Product

Codename

gst-plugins-good1.0

bookworm	vulnerable
bookworm (security)	vulnerable
forky	1.28.7-1 fixed
sid	1.28.7-1 fixed
trixie	vulnerable
trixie (security)	vulnerable

Ubuntu Releases

Ubuntu Product

Codename

gst-plugins-good1.0

bionic	Fixed 1.14.5-0ubuntu1~18.04.3+esm2 released
focal	Fixed 1.16.3-0ubuntu1.3+esm2 released
jammy	Fixed 1.20.3-0ubuntu1.8 released
noble	Fixed 1.24.2-1ubuntu1.6 released
resolute	Fixed 1.28.2-2ubuntu0.2 released
xenial	Fixed 1.8.3-1ubuntu0.5+esm2 released

Red Hat Enterprise Linux Releases

Red Hat Product

Release

gstreamer1-plugins-good

RHEL 8	0:1.16.1-7.el8_10.3 fixed
RHEL 9	0:1.22.12-7.el9_8.2 fixed

gstreamer1-plugins-good-gtk

RHEL 8	0:1.16.1-7.el8_10.3 fixed
RHEL 9	0:1.22.12-7.el9_8.2 fixed

Amazon Linux Releases

Amazon Package

Release

gstreamer-plugins-good

Amazon Linux 2

0:0.10.31-20.amzn2.0.5

fixed

gstreamer-plugins-good-debuginfo

Amazon Linux 2

0:0.10.31-20.amzn2.0.5

fixed

gstreamer-plugins-good-devel-docs

Amazon Linux 2

0:0.10.31-20.amzn2.0.5

fixed

gstreamer1-plugins-good

Amazon Linux 2	0:1.18.4-6.amzn2.0.13 fixed
Amazon Linux 2023	0:1.24.10-1.amzn2023.0.8 fixed

gstreamer1-plugins-good-debuginfo

Amazon Linux 2	0:1.18.4-6.amzn2.0.13 fixed
Amazon Linux 2023	0:1.24.10-1.amzn2023.0.8 fixed

gstreamer1-plugins-good-debugsource

Amazon Linux 2023

0:1.24.10-1.amzn2023.0.8

fixed

gstreamer1-plugins-good-gtk

Amazon Linux 2	0:1.18.4-6.amzn2.0.13 fixed
Amazon Linux 2023	0:1.24.10-1.amzn2023.0.8 fixed

gstreamer1-plugins-good-gtk-debuginfo

Amazon Linux 2023

0:1.24.10-1.amzn2023.0.8

fixed

Common Weakness Enumeration

CWE-770 - Allocation of Resources Without Limits or Throttling
The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

Vulnerability Media Exposure

[GERMAN] GStreamer: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in GStreamer ausnutzen, um Daten zu beschädigen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder möglicherweise beliebigen Code auszuführen.
Published: 2026-08-05T22:00:00+00:00

References

https://0xsemizzz.vercel.app/projects/cve-2026-18649-gstreamer-rtp-dos/

https://access.redhat.com/errata/RHSA-2026:53451

https://access.redhat.com/errata/RHSA-2026:53452

https://access.redhat.com/errata/RHSA-2026:56966

https://access.redhat.com/errata/RHSA-2026:61588

https://access.redhat.com/errata/RHSA-2026:61943

https://access.redhat.com/errata/RHSA-2026:65959

https://access.redhat.com/errata/RHSA-2026:65999

https://access.redhat.com/security/cve/CVE-2026-18649

https://bugzilla.redhat.com/show_bug.cgi?id=2510614

https://github.com/0xSemizzz/CVE-2026-18649

https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/113