Security Advisory 2026-0068

Details

A heap buffer overflow vulnerability in the QCELP RTP depayloader in gst-plugins-good. The depayloader deinterleaves bundled audio frames into a dynamic array whose size is computed once from the header of the first interleaved packet and then cached. Subsequent packets within the same interleaving group skip the allocation logic entirely. The destination slot index for each frame is computed from the header fields of the current packet without validation against the allocated array size. A later packet advertising a larger interleave depth than the first drives the computed index past the array boundaries, causing out-of-bounds reads and writes through unchecked array access.

The vulnerability is triggered when processing crafted QCELP RTP packets that change the interleave parameter between packets within a single interleaving group.

Impact

A malicious third party could trigger heap buffer overflows by providing crafted QCELP RTP packets with inconsistent interleave values, potentially resulting in data corruption, crash, denial of service, or arbitrary code execution.

Solution

The gst-plugins-good 1.28.6 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.6 release

• Release Notes
• GStreamer Plugins Good 1.28.6

Patches

• Patch