Security Advisory 2026-0095 (CVE-2026-119610)
| Summary | Out-of-bounds read in H.264 RTP depayloader |
| Date | 2026-11-06 |
| Affected Versions | GStreamer gst-plugins-good < 1.28.9 |
| IDs | GStreamer-SA-2026-0095 CVE-2026-119610 |
Details
The H.264 RTP depayloader in gst-plugins-good did not properly validate the packet payload length when parsing truncated H.264 RTP aggregation packets. Because a signed value was compared against an unsigned one, an underflowed payload length was treated as a very large positive value and parsing proceeded past the end of the packet data. This resulted in a heap out-of-bounds read of up to 64 KiB, which was also copied into the depayloaded output.
All versions before 1.28.9 are affected.
Impact
A malicious third party could trigger a crash or denial of service by providing crafted H.264 RTP packets, and may be able to disclose parts of process memory through the depayloaded output. There is no risk of arbitrary code execution.
Solution
The gst-plugins-good 1.28.9 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.