CVE-2026-18649: GStreamer H.264/H.265 RTP Depayloader Uncontrolled Memory Growth Vulnerability

Vulnerability Overview CVE ID: CVE-2026-18649 Description: An unrestricted memory growth vulnerability exists in GStreamer's H.264 and H.265 RTP depayloaders ( and ). A remote attacker can cause the target process to allocate memory indefinitely by sending specific RTP packets, ultimately leading to a process crash. Vulnerability Type: Unrestricted Resource Allocation (CWE-770) CVSS Score: 7.5 (High) Attack Vector: Remote Unauthenticated Denial of Service (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Affected Scope Affected Versions: and prior to version 1.28.6 Impact: Remote Unauthenticated Denial of Service Attack Conditions: The attacker must be able to send RTP packets to a pipeline using these depayloaders. No login is required, no malformed packets are needed, and no protocol violations are necessary; only a deliberately incomplete fragment is required. Remediation Fixed Version: GStreamer 1.28.6 Fix Commit: Commit Fix Content: Added the attribute to limit the maximum fragment size for each depayloader, preventing unbounded memory growth. Proof of Concept (PoC) Code Starting the Pipeline Sending Malicious Packets Measurement Results Memory Growth: Memory usage grows linearly as the number of fragments increases. Example Data: - 5,000 fragments: ~7 MB data sent, +8 MB VmData growth - 10,000 fragments: ~13 MB data sent, +17 MB VmData growth - 15,000 fragments: ~20 MB data sent, +26 MB VmData growth - 20,000 fragments: ~27 MB data sent, +35 MB VmData growth - 25,000 fragments: ~33 MB data sent, +44 MB VmData growth - 30,000 fragments: ~40 MB data sent, +53 MB VmData growth - ~32,000 fragments: ~45 MB data sent, process terminated Fix Code Fix Explanation Default Limit: is set to 32 MB. Setting the attribute to 0 indicates no limit, but the default value is 32 MB. Effectiveness: After the fix, GStreamer 1.28.6 and later versions will limit the maximum fragment size for each depayloader, preventing unbounded memory growth.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-18649: GStreamer H.264/H.265 RTP Depayloader Uncontrolled Memory Growth Vulnerability