Security Advisory 2026-0066

Details

Multiple vulnerabilities in the ASF-over-RTP depayloader element (rtpasfdepay) in gst-plugins-ugly. An integer overflow in the padding computation occurs when the reassembled ASF chunk size exceeds the negotiated maximum packet size, causing an underflow in unsigned arithmetic that results in a very large value passed to memset. This produces an unbounded heap out-of-bounds write. Additionally, optional RTP header fields were read before bounds validation, and ASF packet header fields were parsed without checking that the offset stays within the allocated buffer.

Impact

A malicious third party could trigger heap out-of-bounds writes and reads by providing crafted RTP packets with ASF payload data, potentially resulting in a crash or denial of service.

Solution

The gst-plugins-ugly 1.28.5 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.5 release

• Release Notes
• GStreamer Plugins Ugly 1.28.5

Patches

• Patch