CVE Alert: CVE-2026-119610 – Red Hat

A flaw was found in GStreamer’s gst-plugins-good, specifically in the H.264 RTP depayloader element. When processing MTAP16 or MTAP24 multi-time aggregation RTP packets, a signed/unsigned integer conversion error causes the remaining-length counter to underflow to a large positive value when the packet is truncated. This allows a remote, unauthenticated attacker to trigger an out-of-bounds heap read of up to approximately 64 KiB of process memory by sending a single malformed RTP packet. Successful exploitation can crash the receiving GStreamer pipeline (denial of service), and in relay or transcoding deployments where output is accessible to the attacker, may expose adjacent heap contents.

**Risk verdict:** High operational risk for systems accepting untrusted media streams; KEV, SSVC exploitation, PoC and EPSS data are not provided, so active exploitation and priority status cannot be confirmed.

**Why this matters:** A crafted packet could interrupt media processing, disrupting services that rely on continuous streaming. In relay or transcoding systems, attacker-accessible output may also expose process memory, although the extent and usefulness of any disclosure are uncertain.

**Most likely attack path:** An unauthenticated attacker sends malformed H.264 RTP traffic to a reachable pipeline; no user action or prior privilege is needed, and exploitation is low complexity. The stated scope is unchanged, so direct impact is expected within the receiving process rather than automatically enabling lateral movement; downstream exposure depends on how relayed output is handled.

**Who is most exposed:** Prioritise internet- or partner-facing streaming, conferencing, relay and transcoding deployments that process untrusted RTP using the affected depayloader. Isolated systems receiving only trusted traffic are less exposed.

Alert on crashes or repeated restarts of media-processing services.

Capture malformed or truncated MTAP16/MTAP24 RTP packets at ingress.

Check logs for depayloader errors and unexpected pipeline termination.

Review outbound relay traffic for anomalous data after malformed input.

Mitigation and prioritisation:

Confirm exploitation and KEV/EPSS status; obtain missing telemetry before final priority assignment.

Apply the vendor’s fixed package update promptly, following normal testing and change controls.

Until patched, block untrusted H.264 RTP at ingress or disable the affected depayloader.

Isolate exposed pipelines and restrict access to relayed output.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.