Security Advisory 2026-0088

Details

The RTP L8/L16/L24 raw audio depayloaders in gst-plugins-good take the number of audio channels from the SDP-derived caps without any upper bound. For a channel count above the range of predefined channel layouts, the depayloaders write channel position entries beyond the end of a fixed-size array inside the element instance, corrupting adjacent heap memory. The amount of memory written is controlled by the channel count in the stream description.

In addition, the channel position reordering helper in the audio library of gst-plugins-base can access memory beyond a fixed-size internal buffer when called with a channel count above 64.

Impact

A malicious third party could trigger a heap out-of-bounds write by having the application connect to a crafted RTSP stream or complete SDP negotiation with an attacker-controlled peer, for example via playbin, decodebin or webrtcbin, since the affected depayloaders are autoplugged from the SDP payload type mapping. This can result in application crash, denial of service, data corruption, or potentially arbitrary code execution.

Solution

The gst-plugins-base 1.28.8 and gst-plugins-good 1.28.8 releases address the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.8 release

• Release Notes
• GStreamer Plugins Base 1.28.8
• GStreamer Plugins Good 1.28.8

Patches

• Patch