Security Advisory 2026-0051 (ZDI-CAN-29787)

Details

An out-of-bounds read vulnerability in the RTP SBC depayloader element (rtpsbcdepay) in gst-plugins-good. The element fails to validate the size of incoming RTP payload data before parsing the SBC-specific payload header, allowing a one-byte read past the end of the payload when processing packets with no payload data. Additionally, the element does not check whether the reassembly adapter contains data before attempting to extract a buffer from it, and fails to reset local buffer variables to NULL after transferring ownership. When processing a crafted RTP packet with a minimal payload, this results in critical warnings in standard builds. In builds with assertions disabled, the bug further leads to a use-after-free of a GstBuffer object that is subsequently accessed by the RTP base depayloader.

Impact

A malicious third party could trigger an out-of-bounds read by sending a crafted RTP packet to an application using the RTP SBC depayloader, resulting in critical warnings or a crash and denial of service. The impact is minimal in standard builds with assertions enabled, where the bug manifests as recoverable critical warnings. In builds with assertions disabled (not recommended), the bug additionally leads to a use-after-free, but the practical impact remains limited to denial of service as the freed memory is read at fixed offsets for timestamp values rather than control flow data. Since this element processes network-reachable RTP streams, the vulnerability can be exploited remotely without authentication.

Solution

The gst-plugins-good 1.28.5 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.5 release

• Release Notes
• GStreamer Plugins Good 1.28.5

Patches

• Patch