Security Advisory 2026-0086

Details

The H.265 RTP depayloader element in gst-plugins-good did not validate that the RTP payload is long enough before reading the NAL unit header, and, for fragmentation units, before reading the fragment header. A payload that is shorter than the header causes the element to read one or more bytes past the end of the mapped payload buffer.

Impact

An unauthenticated remote RTP sender can trigger an out-of-bounds memory read by sending a single crafted, short RTP packet to a pipeline using the affected element, potentially resulting in a crash or denial of service.

Solution

The gst-plugins-good 1.28.8 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.8 release

• Release Notes
• GStreamer Plugins Good 1.28.8

Patches

• Patch