Security Advisory 2026-0076 (CVE-2026-18649)

Details

The H.264 and H.265 RTP depayload elements (rtph264depay, rtph265depay) in gst-plugins-good did not enforce an upper bound on the size of reassembled fragmentation units (FU-A/AP). When processing fragmented NAL units, each fragment was appended to an internal reassembly buffer without any size limit. A sender that continuously transmits FU-A fragments without ever sending a terminating fragment causes the reassembly buffer to grow without bound until the process exhausts available memory.

Impact

An unauthenticated remote RTP sender can cause denial of service through memory exhaustion by transmitting a stream of syntactically valid FU-A fragments that never complete reassembly. The attack requires only the ability to send RTP packets to a pipeline using the affected depayload elements and does not require authentication, malformed packets, or high packet rates.

Solution

The gst-plugins-good 1.28.6 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• CVE-2026-18649

GStreamer 1.28.6 release

• Release Notes
• GStreamer Plugins Good 1.28.6

Patches

• Patch