CVE-2026-111183

Name of the Vulnerable Software and Affected Versions GStreamer gst-plugins-base versions prior to 1.28.8 GStreamer gst-plugins-good versions prior to 1.28.8

Description A heap-based buffer overflow exists in the RTP L8, L16, and L24 audio depayloaders. This issue can be triggered via crafted RTSP streams or attacker-controlled SDP negotiation, leading to heap out-of-bounds writes. Such memory corruption may result in application crashes or potential remote code execution. The flaw affects applications that accept untrusted RTSP/RTP audio through the affected GStreamer elements.

Recommendations Upgrade gst-plugins-base to version 1.28.8 or a vendor-fixed build. Upgrade gst-plugins-good to version 1.28.8 or a vendor-fixed build. Restrict untrusted streaming peers to minimize the risk of exploitation.