Security Advisory 2026-0066
|
|
| Summary |
Integer overflow and out-of-bounds accesses in ASF-over-RTP depayloader |
| Date |
2026-08-05 |
| Affected Versions |
GStreamer gst-plugins-ugly < 1.28.5 |
| IDs |
GStreamer-SA-2026-0066 |
Details
Multiple vulnerabilities in the ASF-over-RTP depayloader element (rtpasfdepay) in
gst-plugins-ugly. An integer overflow in the padding computation occurs when the
reassembled ASF chunk size exceeds the negotiated maximum packet size, causing an
underflow in unsigned arithmetic that results in a very large value passed to
memset. This produces an unbounded heap out-of-bounds write. Additionally,
optional RTP header fields were read before bounds validation, and ASF packet
header fields were parsed without checking that the offset stays within the
allocated buffer.
Impact
A malicious third party could trigger heap out-of-bounds writes and reads by
providing crafted RTP packets with ASF payload data, potentially resulting in a
crash or denial of service.
Solution
The gst-plugins-ugly 1.28.5 release addresses the issue. People using older
versions of GStreamer should apply the patch and recompile.
References
The GStreamer project
CVE Database Entries
- No CVE number assigned or pending
GStreamer 1.28.5 release
Patches
