CVE-2026-14935— Gstreamer1-plugins-bad-free: gstreamer: webrtcbin accepts remote sdp without a=fingerprint due to inverted presence check
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
GStreamer是GStreamer组织开源的一套用于处理流媒体的框架。 GStreamer存在处理逻辑错误漏洞，该漏洞源于GStreamer的webrtcbin组件中_check_sdp_crypto()函数存在反转的布尔条件，导致接受缺少所需a=fingerprint属性的远程SDP提议或答案，同时错误拒绝包含该属性的SDP，可能被拦截和修改WebRTC信令消息的攻击者利用，绕过SDP级别的DTLS证书指纹绑定，削弱媒体流中间人攻击防御。以下版本受到影响：Red Hat Enterprise Lin
Possible ATT&CK Techniques 3 AI
T1557 · Adversary-in-the-Middle T1040 · Network Sniffing T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 6
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 6 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 7 | any |
affected |
any |
affected | ||
| Red Hat | Red Hat Enterprise Linux 8 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 9 | any |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-14935
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Gstreamer1-plugins-bad-free: gstreamer: webrtcbin accepts remote sdp without a=fingerprint due to inverted presence check
Source: CVE Program / CVE List V5
Vulnerability Description
A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto() function contains an inverted boolean condition that causes it to accept remote SDP offers or answers that lack the required a=fingerprint attribute, while incorrectly rejecting those that include it. An attacker with the ability to intercept and modify WebRTC signaling messages could exploit this to bypass the SDP-level DTLS certificate fingerprint binding, weakening defenses against man-in-the-middle attacks on media streams.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
控制流实现总是不正确
Source: CVE Program / CVE List V5
Vulnerability Title
GStreamer 处理逻辑错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
GStreamer是GStreamer组织开源的一套用于处理流媒体的框架。 GStreamer存在处理逻辑错误漏洞，该漏洞源于GStreamer的webrtcbin组件中_check_sdp_crypto()函数存在反转的布尔条件，导致接受缺少所需a=fingerprint属性的远程SDP提议或答案，同时错误拒绝包含该属性的SDP，可能被拦截和修改WebRTC信令消息的攻击者利用，绕过SDP级别的DTLS证书指纹绑定，削弱媒体流中间人攻击防御。以下版本受到影响：Red Hat Enterprise Lin
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
II. Public POCs for CVE-2026-14935
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14935
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-14935 (1)
Vendor Advisories for CVE-2026-14935 (2)
Other References for CVE-2026-14935 (1)
Same Patch Batch · Red Hat · 2026-07-07 · 7 CVEs total
| CVE-2026-14474 | 8.8 HIGH | Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by defa |
| CVE-2026-14476 | 8.0 HIGH | Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authen |
| CVE-2026-58384 | 7.3 HIGH | Gimp: gimp: integer overflow in read_rle_channel() |
| CVE-2025-12799 | 6.5 MEDIUM | Jastow: jastow cross-site scripting attack due to unsanitized uri |
| CVE-2026-14940 | 5.3 MEDIUM | 389-ds-base: 389-ds-base: heap-buffer-overflow in dn normalization via quoted multivalued |
| CVE-2026-14969 | 4.4 MEDIUM | 389-ds-base: 389-ds-base: static initialization vector in aes-cbc/3des-cbc attribute encry |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-95520
Rpm: rpm: integer overflow in iterreadarchivenext() leads to -
CVE-2026-97029
Flatpak: flatpak: sandboxed app can signal unsandboxed proce -
CVE-2026-97024
Flatpak: flatpak: arbitrary write in root context via path t -
CVE-2026-97027
Flatpak: flatpak: denial of service via unsanitized keys in -
CVE-2026-97026
Flatpak: flatpak: world-writable temporary child repositorie
Same vendor: Red Hat
-
CVE-2026-95520
Rpm: rpm: integer overflow in iterreadarchivenext() leads to -
CVE-2026-102474
Dash: dash: heap out-of-bounds write in conv_escape via unde -
CVE-2026-102473
Dash: dash: super-polynomial backtracking in pmatch when lib -
CVE-2026-97029
Flatpak: flatpak: sandboxed app can signal unsandboxed proce -
CVE-2026-97024
Flatpak: flatpak: arbitrary write in root context via path t
Same weakness: CWE-670
-
CVE-2026-73468
Security Advisory 0175 -
CVE-2026-55624
MintyItanium Lost-Auction takes items like barrier blocks ou -
CVE-2026-72705
Rocq Prover before 9.2.0 Guard Checker Accepts Fixpoint Pass -
CVE-2026-72704
Rocq Prover through 9.2.0 Guard Checker Trusts Corrupted Rec -
CVE-2026-72703
Rocq Prover 8.20 before 9.2.0 Guard Checker Accepts Non-Term
V. Comments for CVE-2026-14935
No comments yet