{"id":"CVE-2026-119610","kind":"vulnerability","aliases":["CVE-2026-119610"],"related":[],"title":"GStreamer gst-plugins-good: malformed H.264 RTP packet causes out-of-bounds heap read","description":"A flaw was found in GStreamer's gst-plugins-good, specifically in the H.264 RTP depayloader element. When processing MTAP16 or MTAP24 multi-time aggregation RTP packets, a signed/unsigned integer conversion error causes the remaining-length counter to underflow to a large positive value when the packet is truncated. This allows a remote, unauthenticated attacker to trigger an out-of-bounds heap read of up to approximately 64 KiB of process memory by sending a single malformed RTP packet. Successful exploitation can crash the receiving GStreamer pipeline (denial of service), and in relay or transcoding deployments where output is accessible to the attacker, may expose adjacent heap contents.","summary":"A malformed MTAP16 or MTAP24 RTP packet makes the H.264 RTP depayloader in gst-plugins-good underflow a length counter and read past a heap buffer. An attacker can crash the GStreamer pipeline with one packet and, in relay or transcoding setups, may expose nearby heap contents.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"gst-plugins-good","fixed":["1.28.9"],"affected":"< 1.28.9","ecosystem":"vendor"}],"ecosystems":[],"tags":["gst-plugins-good","gstreamer","h264","media-servers","package","rtp"],"not_affected_if":["local-files-only","no-rtp-h264-input"],"how_to_check":"Run gst-inspect-1.0 --version and check the gst-plugins-good package version (e.g. dpkg -l gstreamer1.0-plugins-good, rpm -q gstreamer1-plugins-good); anything below 1.28.9 is affected if pipelines use rtph264depay on untrusted RTP input. Distro packages may carry a backport, so check your distro's advisory.","fix":"Upgrade gst-plugins-good to 1.28.9 (or apply https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12991.patch and rebuild)","status":"open","published_at":"2026-11-09T13:17:05+00:00","first_seen_at":"2026-11-09T13:26:50+00:00","triaged_at":"2026-11-09T13:27:31+00:00","updated_at":"2026-11-09T13:28:13+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-09T13:27:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"GStreamer gst-plugins-good: malformed H.264 RTP packet causes out-of-bounds heap read","impact":"medium","summary":"A malformed MTAP16 or MTAP24 RTP packet makes the H.264 RTP depayloader in gst-plugins-good underflow a length counter and read past a heap buffer. An attacker can crash the GStreamer pipeline with one packet and, in relay or transcoding setups, may expose nearby heap contents.","audience":"developers","category":"package","nicknames":[],"who_cares":["gstreamer","gst-plugins-good","rtp","h264","media-servers"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Pipeline crashes; adjacent heap memory may leak in relay setups","analyst_note":"Find the affected and fixed gst-plugins-good versions from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-119610) and the GStreamer advisory.","how_to_check":"- Check whether the GStreamer H.264 RTP depayloader (rtph264depay) from gst-plugins-good is in use, for example in a pipeline that receives RTP video from the network.\n- Check the installed gst-plugins-good version with `gst-inspect-1.0 --version` or your package manager.\n- unknown for the affected version ranges, as the sources do not list them.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-rtp-h264-input","local-files-only"],"who_is_affected":"Systems that run GStreamer pipelines which receive H.264 over RTP from untrusted networks, such as streaming relays, transcoders and media servers, are exposed. Pipelines that only play local files or do not depayload RTP H.264 from the network are unlikely to be reached. The sources do not give affected version ranges.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000816,"input_tokens":4693,"output_tokens":693,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed gst-plugins-good versions from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-119610) and the GStreamer advisory.","search":"'-119610':19A,22A '-2026':18A,21A '64':157C 'access':189C 'adjac':195C 'aggreg':112C 'allow':139C 'approxim':156C 'attack':66B,143C,192C 'bound':14A,150C 'buffer':64B 'caus':10A,120C 'content':85B,197C 'convers':118C 'counter':58B,125C 'crash':68B,172C 'cve':17A,20A 'denial':177C 'depayload':49B,102C 'deploy':185C 'element':103C 'error':119C 'exploit':170C 'expos':82B,194C 'flaw':87C 'found':89C 'good':5A,26A,30B,54B,96C 'gst':3A,24A,28B,52B,94C 'gst-plugins-good':2A,23A,27B,51B,93C 'gstreamer':1A,31B,70B,91C,175C 'h.264':7A,47B,100C 'h264':32B 'heap':15A,63B,84B,151C,196C 'integ':117C 'kib':158C 'larg':130C 'length':57B,124C 'make':45B 'malform':6A,39B,166C 'may':81B,193C 'media':34B 'media-serv':33B 'memori':161C 'mtap16':40B,106C 'mtap24':42B,108C 'multi':110C 'multi-tim':109C 'nearbi':83B 'one':73B 'out-of-bound':11A,147C 'output':187C 'packag':36B 'packet':9A,44B,74B,114C,135C,168C 'past':61B 'pipelin':71B,176C 'plugin':4A,29B,53B,95C 'plugins':25A 'posit':131C 'process':105C,160C 'read':16A,60B,152C 'receiv':174C 'relay':77B,182C 'remain':123C 'remaining-length':122C 'remot':141C 'rtp':8A,37B,43B,48B,101C,113C,167C 'send':163C 'server':35B 'servic':179C 'setup':80B 'signed/unsigned':116C 'singl':165C 'specif':97C 'success':169C 'time':111C 'transcod':79B,184C 'trigger':145C 'truncat':137C 'unauthent':142C 'underflow':55B,127C 'valu':132C","nicknames":[],"mitigations":[],"who_affected":"Applications and media servers that use GStreamer's H.264 RTP depayloader (rtph264depay from gst-plugins-good) on RTP streams from untrusted sources, such as RTSP/WebRTC ingest, relays and transcoders. A malformed MTAP16/MTAP24 packet makes a length underflow, causing a heap read of up to 64 KiB that is copied into the output; the vendor lists crash/denial of service and possible process memory disclosure, and says no arbitrary code execution risk. Systems that never process H.264 over RTP can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-09T13:28:13Z","by":"analyst","doc":"https://gstreamer.freedesktop.org/security/sa-2026-0095.html","run_id":2290},"products":{"at":"2026-11-09T13:28:13Z","by":"analyst","doc":"https://gstreamer.freedesktop.org/security/sa-2026-0095.html","run_id":2290},"how_to_check":{"at":"2026-11-09T13:28:13Z","by":"analyst","doc":"https://gstreamer.freedesktop.org/security/sa-2026-0095.html","run_id":2290},"who_affected":{"at":"2026-11-09T13:28:13Z","by":"analyst","doc":"https://gstreamer.freedesktop.org/security/sa-2026-0095.html","run_id":2290}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["gstpluginsgood"],"ptokens":["good","gst","plugins"],"labels":["gstpluginsgood","gstreamer","h264","high","mediaservers","package","rtp"],"campaign_type":null,"search_a":"'-119610':19A,22A '-2026':18A,21A 'bound':14A 'caus':10A 'cve':17A,20A 'good':5A,26A 'gst':3A,24A 'gst-plugins-good':2A,23A 'gstreamer':1A 'h.264':7A 'heap':15A 'malform':6A 'out-of-bound':11A 'packet':9A 'plugin':4A 'plugins':25A 'read':16A 'rtp':8A","search_b":"'attack':66B 'buffer':64B 'content':85B 'counter':58B 'crash':68B 'depayload':49B 'expos':82B 'good':30B,54B 'gst':28B,52B 'gst-plugins-good':27B,51B 'gstreamer':31B,70B 'h.264':47B 'h264':32B 'heap':63B,84B 'length':57B 'make':45B 'malform':39B 'may':81B 'media':34B 'media-serv':33B 'mtap16':40B 'mtap24':42B 'nearbi':83B 'one':73B 'packag':36B 'packet':44B,74B 'past':61B 'pipelin':71B 'plugin':29B,53B 'read':60B 'relay':77B 'rtp':37B,43B,48B 'server':35B 'setup':80B 'transcod':79B 'underflow':55B","search_c":"'64':157C 'access':189C 'adjac':195C 'aggreg':112C 'allow':139C 'approxim':156C 'attack':143C,192C 'bound':150C 'caus':120C 'content':197C 'convers':118C 'counter':125C 'crash':172C 'denial':177C 'depayload':102C 'deploy':185C 'element':103C 'error':119C 'exploit':170C 'expos':194C 'flaw':87C 'found':89C 'good':96C 'gst':94C 'gst-plugins-good':93C 'gstreamer':91C,175C 'h.264':100C 'heap':151C,196C 'integ':117C 'kib':158C 'larg':130C 'length':124C 'malform':166C 'may':193C 'memori':161C 'mtap16':106C 'mtap24':108C 'multi':110C 'multi-tim':109C 'out-of-bound':147C 'output':187C 'packet':114C,135C,168C 'pipelin':176C 'plugin':95C 'posit':131C 'process':105C,160C 'read':152C 'receiv':174C 'relay':182C 'remain':123C 'remaining-length':122C 'remot':141C 'rtp':101C,113C,167C 'send':163C 'servic':179C 'signed/unsigned':116C 'singl':165C 'specif':97C 'success':169C 'time':111C 'transcod':184C 'trigger':145C 'truncat':137C 'unauthent':142C 'underflow':127C 'valu':132C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T13:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119610","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119610","severity":null,"published_at":"2026-11-09T13:17:05+00:00","modified_at":"2026-11-09T13:17:06+00:00","first_seen_at":"2026-11-09T13:26:50+00:00","fetched_at":"2026-11-09T13:26:50+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119610:2290","url":"https://gstreamer.freedesktop.org/security/sa-2026-0095.html","severity":null,"published_at":"2026-11-09T13:28:13+00:00","modified_at":"2026-11-09T13:28:13+00:00","first_seen_at":"2026-11-09T13:28:13+00:00","fetched_at":"2026-11-09T13:28:13+00:00","note":"Read GStreamer-SA-2026-0095 (vendor): affected gst-plugins-good < 1.28.9, fixed 1.28.9, patch MR 12991. NVD page returned no content via WebFetch; web-cli search out of credits; X not checked. Exploitation status not stated by vendor; PoC not looked for.","cites":["https://gstreamer.freedesktop.org/security/sa-2026-0095.html"]}],"documents":[{"id":107627,"url":"https://gstreamer.freedesktop.org/security/sa-2026-0095.html","title":"GStreamer-SA-2026-0095: Out-of-bounds read in H.264 RTP depayloader","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}