Live › vulnerability › CVE-2026-111183
Go to dashboardThe rtpL16depay element in GStreamer's good and base plugin sets copies user-supplied RTP payload data into a heap buffer without checking its length. An attacker who can send crafted RTP packets to an application that processes them can overwrite heap memory and run code in that process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| gst-plugins-good | gstreamer | < 1.28.8 | 1.28.8 |
| gst-plugins-base | gstreamer | < 1.28.8 | 1.28.8 |
Check the installed GStreamer plugin versions with gst-inspect-1.0 --version or your package manager, and look for rtpL16depay in apps that receive RTP or RTSP streams.
Upgrade gst-plugins-good and gst-plugins-base to 1.28.8 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the processing of RTP payload elements. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31143.
This page as .md · .json · in your agent: get_signal("CVE-2026-111183")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.