Live › vulnerability › CVE-2026-121625
GNU Gatekeeper (gnugk) before 5.16 has an out-of-bounds read in ParseRTCP() that lets a remote RTP peer read heap memory past received packets. A crafted RTCP SDES packet without a NUL byte can crash the gatekeeper.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 18:22 UTC. All times on this page are UTC.
Only deployments that proxy H.323 calls through gnugk with EnableRTCPStats turned on are described as exposed. A remote RTP peer able to reach the media proxy port can send the crafted packets, and the sources describe a crash rather than code execution.
No product ranges from the sources yet.
5.16.EnableRTCPStats is enabled in the gatekeeper configuration; the sources say the issue needs it on.5.16 or later (the sources name a patch and release notes for the fix; exact range not stated).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in ParseRTCP() in ProxyChannel.cxx that allows remote RTP peers to read heap memory past received packets. Attackers can send RTCP SDES items lacking a NUL byte to the media proxy port during proxied H.323 calls with EnableRTCPStats enabled, crashing the gatekeeper.
This page as .md · .json · in your agent: get_signal("CVE-2026-121625")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.