Security Advisory 2026-0091
| Summary | Out-of-bounds read in RTCP SDES privately defined entry handling |
| Date | 2026-10-08 |
| Affected Versions | GStreamer gst-plugins-good < 1.28.8 |
| IDs | GStreamer-SA-2026-0091 |
Details
An out-of-bounds read vulnerability in the RTP session handling of gst-plugins-good, which processes incoming RTCP (RTP Control Protocol) packets. When handling a privately defined source description (SDES PRIV) entry, the length of the private name prefix is taken from the packet without validating it against the length of the entry. A crafted RTCP SDES packet can therefore make the processing read beyond the end of the packet buffer.
This affects all versions of gst-plugins-good prior to 1.28.8.
Impact
A malicious third party could trigger an out-of-bounds heap read by having the application process a crafted RTCP SDES packet, for example by connecting to a malicious RTSP server or by exchanging RTP/RTCP with an attacker-controlled peer, for instance via rtspsrc, rtpbin or webrtcbin. This can result in application crash, denial of service, or information disclosure of heap memory contents.
Solution
The gst-plugins-good 1.28.8 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.
References
The GStreamer project
CVE Database Entries
- No CVE number assigned or pending