GStreamer gst-plugins-good OOB Read Vulnerability (CVE-2026-18299)

Vulnerability Overview Vulnerability Name: Out-of-bounds read in RTP SBC depayloader Release Date: 2026-07-08 Affected Versions: GStreamer gst-plugins-good < 1.28.5 ID: - GStreamer-SA-2026-0051 - ZDI-CAN-29787 - CVE-2026-18299 Scope of Impact Description: There is an out-of-bounds read vulnerability in the RTP SBC depayloader element ( ). When processing RTP packets without payload data, this element fails to validate the size of the incoming RTP payload data, allowing it to read one byte beyond the end of the payload before parsing the SBC-specific payload header. Furthermore, when attempting to extract data from the reassembly adapter, the element does not check whether the reassembly adapter contains data, and it fails to reset the local buffer variable to after transferring ownership. Handling malicious RTP packets with minimal payloads triggers a critical warning in standard builds. Additionally, this may lead to a use-after-free issue when the object is subsequently accessed by the RTP base depayloader. Impact: A malicious third party can trigger the out-of-bounds read by sending carefully crafted RTP packets, resulting in critical warnings, crashes, or denial of service. In standard builds with assertions enabled, the impact is minimal, manifesting as a recoverable critical warning. In builds with assertions disabled (not recommended), the vulnerability may also lead to use-after-free; however, the practical impact is limited to denial of service, as the freed memory is read at a fixed offset rather than controlling control flow data. Since this element processes network-accessible RTP streams, the vulnerability can be exploited remotely without authentication. Remediation Solution: The vulnerability has been resolved in GStreamer gst-plugins-good version 1.28.5. Users of older versions should apply the patch and recompile. References: - GStreamer Project - CVE Database Entry - GStreamer 1.28.5 Release Notes - GStreamer Plugins Good 1.28.5 Release Notes - Patch POC Code or Exploit Code No POC code or exploit code was provided in the source material.

Goal Reached Thanks to every supporter — we hit 100%!

GStreamer gst-plugins-good OOB Read Vulnerability (CVE-2026-18299)