漏洞概述 漏洞编号：Bug 2510614 (CVE-2026-18649) 漏洞名称：gst-plugins-good: gst-plugins-good: unbounded memory growth in rtp264depay and rtp265depay RTP depayloaders 报告时间：2026-08-03 11:34 UTC by OSIDB Bzreport 修改时间：2026-08-06 06:43 UTC (History) 状态：NEW 别名：CVE-2026-18649 产品：Security Response 组件：vulnerability 版本：unspecified 硬件：All 操作系统：Linux 优先级：medium 严重性：medium 目标里程碑：--- 分配给：Product Security QA联系人：--- 文档联系人：--- URL：--- 白名单：--- 依赖项：2511924 阻塞项：--- 树视图：depends on / blocked 影响范围 受影响产品：GStreamer gst-plugins-good 具体模块：rtp264depay 和 rtp265depay RTP depayloaders 漏洞类型：无界内存增长（unbounded memory growth） 触发条件：通过发送一个起始片段（Start Fragment, S=1, E=0）后跟随无限数量的连续片段（Continuation Fragments, S=0, E=0），可以导致内存增长直到进程内存耗尽。 相同漏洞存在于：gstrtph265depay.c 中的 FU 处理程序（case 49 in gst_rtp_h265_depay_process()） 修复方案 修复状态：已在私有安全 Merge Request #151 中确认，计划在 GStreamer 1.26.6 或 1.26.7 中发布。 确认版本：已在 GStreamer 1.28.3 和 1.28.5 中确认（动态测试）。 报告者：Yehia Ali Mohamed Ezat (ywhahazat750) PSIRT 票号：PSIRTSUPT-26647 POC代码或利用代码 页面中未包含具体的POC代码或利用代码。 其他信息 CC列表：3 users (china) 固定版本：--- 关闭原因：--- 环境：--- 最后关闭：--- Embargoed：--- 附件 附件名称：(Terms of Use) 描述：GStreamer gst-plugins-good contains an unbounded memory growth vulnerability in the rtp264depay and rtp265depay RTP depayloaders. In gstrtph264depay.c, the FU-A/FU-B fragmentation handler (case 28/29 in gst_rtp_h264_depay_process()) accumulates incoming RTP fragment payloads into a GstAdapter via gst_adapter_push() without enforcing any maximum assembly size. The adapter is only flushed when the End bit is set in the FU header, which triggers gst_rtp_h264_finish_fragmentation_unit(). If an attacker sends a start fragment (S=1, E=0) followed by an unlimited stream of continuation fragments (S=0, E=0) with sequential RTP sequence numbers, the memory grows without bound until process memory is exhausted. The same flaw exists in gstrtph265depay.c in the FU handler (case 49 in gst_rtp_h265_depay_process()). The GStreamer security team confirmed the vulnerability and that rtp265depay is also affected. A fix is pending in private security Merge Request #151 planned for release in GStreamer 1.26.6 or 1.26.7. Confirmed on GStreamer 1.28.3 and 1.28.5 (dynamic testing). Reported by Yehia Ali Mohamed Ezat (ywhahazat750). PSIRT Ticket: PSIRTSUPT-26647. 备注 需要登录才能在此漏洞上发表评论或进行更改。