CVE 2026 119610

A flaw was found in GStreamer's gst-plugins-good, specifically in the H.264 RTP depayloader element. When processing MTAP16 or MTAP24 multi-time aggregation RTP packets, a signed/unsigned integer conversion error causes the remaining-length counter to underflow to a large positive value when the packet is truncated. This allows a remote, unauthenticated attacker to trigger an out-of-bounds heap read of up to approximately 64 KiB of process memory by sending a single malformed RTP packet. Successful exploitation can crash the receiving GStreamer pipeline (denial of service), and in relay or transcoding deployments where output is accessible to the attacker, may expose adjacent heap contents.

This vulnerability is rated Important severity because a remote, unauthenticated attacker can trigger an out-of-bounds heap read and denial of service with a single malformed H.264 RTP packet on any pipeline that auto-plugs the rtph264depay element. The vulnerable MTAP16/MTAP24 code path was introduced in upstream gst-plugins-good 1.28.0. Red Hat product impact analysis is in progress: RHEL and related products ship gstreamer1-plugins-good at versions below 1.28.0 today and are expected not to include this code path until rebased; Fedora 44 ships gstreamer1-plugins-good 1.28.8 and is affected pending confirmation.

Block untrusted H.264 RTP streams at the network perimeter (firewall or UDP ingress filter) to prevent malformed packets from reaching GStreamer pipelines. Alternatively, disable or avoid deploying the rtph264depay GStreamer element when processing RTP from untrusted sources.

Bugzilla 2563952 : gstreamer1-plugins-good: gstreamer1-plugins-good: out-of-bounds heap read in MTAP16/MTAP24 H.264 RTP depayloader via signed/unsigned underflow

CWE-125 : Out-of-bounds Read

Common Vulnerability Scoring System (CVSS) Score Details

Info alert: Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications ).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Red Hat CVSS v3 Score Explanation

Network-delivered single UDP/RTP packet; unauthenticated; no user interaction required on server pipelines; DoS (crash) is high; heap-content leak into output stream is low (requires observable relay/transcode path)

Understanding the Weakness (CWE)

Technical Impact: Read Memory

An attacker could get secret values such as cryptographic keys, PII, memory addresses, or other information that could be used in additional attacks.

Technical Impact: Bypass Protection Mechanism

Out-of-bounds memory could contain memory addresses or other information that can be used to bypass ASLR and other protection mechanisms in order to improve the reliability of exploiting a separate weakness for code execution.

Technical Impact: DoS: Crash, Exit, or Restart

An attacker could cause a segmentation fault or crash by causing memory to be read outside of the bounds of the buffer. This is especially likely when the code reads a variable amount of data and assumes that a sentinel exists to stop the read operation, such as a NUL in a string.

Technical Impact: Varies by Context

The read operation could produce other undefined or unexpected results.

Upstream acknowledges Ada Logics (Ada Logics) and Claude (Anthropic) as the original reporters.

Frequently Asked Questions

"Under investigation" doesn't necessarily mean that the product is affected by this vulnerability. It only means that our Analysis Team is still working on determining whether the product is affected and how it is affected.

The term 'Affected' means that our Analysis team has determined that this product, such as Red Hat Enterprise Linux 8 or OpenShift Container Platform 4, is affected by this vulnerability and a fix may be released to address this issue in the near future. This includes all minor releases of this product unless noted otherwise in the Statement text.

Upgrade to a supported product version that includes a fix for this vulnerability (recommended).

Apply a mitigation (if one exists).

Customers with the Technical Account Manager (TAM) RHEL Security Select Add-on can review this CVE directly with their TAM.

Apply a mitigation (if one exists).

Red Hat Engineering focuses on addressing high-priority issues based on the impact and product lifecycle expectations. Therefore, lower-priority issues will not receive immediate fixes.

Customers with the technical account manager (TAM) RHEL Security Select Add-on can review this CVE directly with their TAM.

Not sure what something means? Check out our Security Glossary .

For clarification or corrections, please Red Hat Product Security .