CVE-2026-121626— GNU Gatekeeper before 5.16 Out-of-Bounds Read in H.460.24 RTCP Probe Handler

Quick assessment

Affected

willamowius gnugk

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 5.16 版本之前的 GNU Gatekeeper（gnugk）中，函数存在一个越界读取漏洞。远程攻击者可通过发送简短的探测数据包，引发堆区越界读取（heap over-read）。攻击者可以在执行 H.460.24 探测期间，向媒体端口发送一个自定义的简短 RTCP 应用数据包，从而读取超出堆分配范围的内存，可能导致 gatekeeper 崩溃。

CVSS 3.7 · Low Updated Nov 04, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

GNU Gatekeeper before 5.16 Out-of-Bounds Read in H.460.24 RTCP Probe Handler

Source: CVE Program / CVE List V5

Vulnerability Description

GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in H46024Socket::ReceivedProbePacket() that allows remote attackers to cause a heap over-read by sending short probe packets. Attackers can send a short application-defined RTCP packet to the media port during H.460.24 probing to read past the heap allocation and possibly crash the gatekeeper.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存读

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
willamowius	gnugk	0 ~ 5.16	-

II. Public POCs for CVE-2026-121626

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121626

请登录查看更多情报信息。

Other References for CVE-2026-121626 (5)

https://github.com/willamowius/gnugk/blob/v5_15/GkClient.cxx#L963-L990 technical-description
https://github.com/willamowius/gnugk product
https://github.com/willamowius/gnugk/commit/160aa27344ecc9a443cccaa63e8d7fa95a766610 patch
https://github.com/willamowius/gnugk/releases/tag/v5_16 release-notes
https://www.vulncheck.com/advisories/gnu-gatekeeper-before-5.16-out-of-bounds-read-in-h-460.24-rtcp-probe-handler third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121626

IV. Related Vulnerabilities

Same product: gnugk

CVE-2026-121625
GNU Gatekeeper before 5.16 Out-of-Bounds Read via RTCP SDES

Same vendor: willamowius

CVE-2026-121625
GNU Gatekeeper before 5.16 Out-of-Bounds Read via RTCP SDES

Same weakness: CWE-125