CVE-2026-18649

Name of the Vulnerable Software and Affected Versions GStreamer gst-plugins-good (affected versions not specified)

Description A flaw exists in the rtph264depay and rtph265depay RTP depayloader elements. These elements fail to enforce a maximum size limit on the reassembly buffer during the processing of fragmented RTP packets. A remote, unauthenticated attacker can exploit this by sending a continuous stream of RTP fragments without an end-of-fragment marker, causing the buffer to grow indefinitely until process memory is exhausted, leading to a denial of service via process termination.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.