---
id: "CVE-2026-119610"
page: "https://infrastack.ai/live/CVE-2026-119610"
kind: "vulnerability"
aliases: ["CVE-2026-119610"]
title: "GStreamer gst-plugins-good: malformed H.264 RTP packet causes out-of-bounds heap read"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "gst-plugins-good", "fixed": ["1.28.9"], "affected": "< 1.28.9", "ecosystem": "vendor"}]
ecosystems: []
tags: ["gst-plugins-good", "gstreamer", "h264", "media-servers", "package", "rtp"]
not_affected_if: ["local-files-only", "no-rtp-h264-input"]
published_at: "2026-11-09T13:17:05+00:00"
first_seen_at: "2026-11-09T13:26:50+00:00"
updated_at: "2026-11-09T13:28:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119610", "first_seen_at": "2026-11-09T13:26:50+00:00"}, {"source": "analyst", "url": "https://gstreamer.freedesktop.org/security/sa-2026-0095.html", "first_seen_at": "2026-11-09T13:28:13+00:00", "cites": ["https://gstreamer.freedesktop.org/security/sa-2026-0095.html"]}]
exploit_sources: []
---

# GStreamer gst-plugins-good: malformed H.264 RTP packet causes out-of-bounds heap read

Link for people: https://infrastack.ai/live/CVE-2026-119610 (this .md is for agents)

A malformed MTAP16 or MTAP24 RTP packet makes the H.264 RTP depayloader in gst-plugins-good underflow a length counter and read past a heap buffer. An attacker can crash the GStreamer pipeline with one packet and, in relay or transcoding setups, may expose nearby heap contents.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:gst-plugins-good affected < 1.28.9 fixed 1.28.9

## How to check

Run gst-inspect-1.0 --version and check the gst-plugins-good package version (e.g. dpkg -l gstreamer1.0-plugins-good, rpm -q gstreamer1-plugins-good); anything below 1.28.9 is affected if pipelines use rtph264depay on untrusted RTP input. Distro packages may carry a backport, so check your distro's advisory.

## Fix

Upgrade gst-plugins-good to 1.28.9 (or apply https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12991.patch and rebuild)

## Timeline

- 2026-11-09T13:26:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119610
- 2026-11-09T13:28:13+00:00 analyst https://gstreamer.freedesktop.org/security/sa-2026-0095.html — Read GStreamer-SA-2026-0095 (vendor): affected gst-plugins-good < 1.28.9, fixed 1.28.9, patch MR 12991. NVD page returned no content via WebFetch; web-cli search out of credits; X not checked. Exploitation status not stated by vendor; PoC not looked for.

## Documents

- [advisory] GStreamer-SA-2026-0095: Out-of-bounds read in H.264 RTP depayloader https://gstreamer.freedesktop.org/security/sa-2026-0095.html

## From the sources

A flaw was found in GStreamer's gst-plugins-good, specifically in the H.264 RTP depayloader element. When processing MTAP16 or MTAP24 multi-time aggregation RTP packets, a signed/unsigned integer conversion error causes the remaining-length counter to underflow to a large positive value when the packet is truncated. This allows a remote, unauthenticated attacker to trigger an out-of-bounds heap read of up to approximately 64 KiB of process memory by sending a single malformed RTP packet. Successful exploitation can crash the receiving GStreamer pipeline (denial of service), and in relay or transcoding deployments where output is accessible to the attacker, may expose adjacent heap contents.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_