Redpacketsecurity CVE-2026-119610: GStreamer Vulnerability Exposes Media Processing Systems
Article Content
- •CVE-2026-119610 affects GStreamer versions before 1.28.9.
- •Attackers can exploit the flaw by sending malformed H.264 RTP packets.
- •Users are urged to block untrusted streams and apply patches immediately.
A significant vulnerability, CVE-2026-119610, has been identified in GStreamer's H.264 RTP depayloader, affecting versions prior to 1.28.9. This flaw allows unauthenticated attackers to exploit a signed/unsigned integer conversion error, leading to an out-of-bounds heap read of up to 64 KiB of process memory by sending a malformed RTP packet. The potential impact includes denial of service and possible exposure of sensitive adjacent heap contents in relay or transcoding deployments. Red Hat products are at risk, as they currently ship versions below 1.28.0, while Fedora 44 is affected with version 1.28.8. Users are advised to block untrusted H.264 RTP streams and apply patches promptly. The vulnerability was published on November 9, 2026, with a CVSS score of 8.2, indicating high severity. No active exploitation has been confirmed yet.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (4)
Following this threat?
Track Red Hat and CVE-2026-119610 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What versions of GStreamer are affected?
What should I do to protect my systems?
Is there evidence of active exploitation?
Continue Reading
Critical RCE Vulnerability in Confection WordPress Plugin (CVE-2026-115252) A critical vulnerability, CVE-2026-115252, has been identified in the Confection WordPress Cable plugin, affecting versions 0.4.0 to 0.4.7. This flaw allows unauthenticated attackers to execute arbitrary PHP code on the server by writing unmodified settings into a PHP file without proper checks. The vulnerability has… 
Critical Code Injection Vulnerability in Staggs Plugin for WordPress A critical code injection vulnerability, CVE-2026-78287, has been identified in the Staggs plugin for WordPress, affecting versions up to 3.3.0. This flaw allows unauthenticated attackers to execute arbitrary code remotely, posing severe risks to affected sites. The vulnerability stems from improper control over code…