Security Advisory 2026-0057

Details

An out-of-bounds read vulnerability in the RTP JPEG depayloader in gst-plugins-good. When processing RTP packets with custom quantization tables, the precision field is used to determine how many bytes to copy from the quantization table data, but the length field provided by the packet is only validated against the total payload size. An attacker can craft a packet where the precision field indicates large 16-bit quantization tables while the length field specifies a much smaller amount of actual data. The subsequent memory copy then reads past the end of the quantization table region into adjacent memory in the RTP payload buffer.

Impact

A malicious third party could trigger an out-of-bounds read by sending a crafted RTP packet to an application using the RTP JPEG depayloader. This can result in a crash and denial of service, or potentially leak heap memory contents into the reconstructed JPEG output. Since this element processes network-reachable RTP streams, the vulnerability can be exploited remotely without authentication.

Solution

The gst-plugins-good 1.28.5 release addresses the issue by validating that the precision-derived quantization table size matches the actual length field before copying table data.

Note that the rtpjpegdepay element is deprecated. Users should migrate to rtpjpegdepay2 and generally the new Rust-based RTP payloader/depayloader elements. These follow the specifications more closely and solve many of the problems present in the older C-based elements.

People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.5 release

• Release Notes
• GStreamer Plugins Good 1.28.5

Patches

• Patch