Security Advisory 2026-0044

Details

An out-of-bounds read vulnerability in the RTP CELT depayloader in gst-plugins-good. The payload parsing loop reads frame size prefix bytes from the RTP packet payload without validating that the read offset remains within the payload boundary. A crafted RTP packet with an all-0xFF payload causes the offset to advance past the end of the payload buffer. The subsequent attempt to extract a sub-buffer then fails and returns NULL, which is dereferenced without checking, resulting in a NULL pointer dereference.

Impact

A malicious third party could trigger a NULL pointer dereference by sending a crafted RTP packet to an application using the RTP CELT depayloader, resulting in a crash and denial of service. Since this element processes network-reachable RTP streams, the vulnerability can be exploited remotely without authentication.

Solution

The gst-plugins-good 1.28.5 release addresses the issue by disabling the RTP CELT depayloader element entirely. CELT was an experimental audio codec that never gained adoption and was superseded by Opus more than a decade ago. There are no CELT decoders or encoders in GStreamer, and the RTP mapping specification never progressed beyond draft status. The element should not be used. Future releases of GStreamer will remove it completely.

People using older versions of GStreamer should apply the patch and recompile, or disable the element to mitigate the vulnerability.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.5 release

• Release Notes
• GStreamer Plugins Good 1.28.5

Patches

• Patch