Security Advisory 2026-0086
|
|
| Summary |
Out-of-bounds read in H.265 RTP depayloader when processing short packets |
| Date |
2026-10-08 |
| Affected Versions |
GStreamer gst-plugins-good < 1.28.8 |
| IDs |
GStreamer-SA-2026-0086 |
Details
The H.265 RTP depayloader element in gst-plugins-good did not validate that the
RTP payload is long enough before reading the NAL unit header, and, for
fragmentation units, before reading the fragment header. A payload that is
shorter than the header causes the element to read one or more bytes past the
end of the mapped payload buffer.
Impact
An unauthenticated remote RTP sender can trigger an out-of-bounds memory read
by sending a single crafted, short RTP packet to a pipeline using the affected
element, potentially resulting in a crash or denial of service.
Solution
The gst-plugins-good 1.28.8 release addresses the issue. People using older
versions of GStreamer should apply the patch and recompile.
References
The GStreamer project
CVE Database Entries
- No CVE number assigned or pending
GStreamer 1.28.8 release
Patches
