{"id":"CVE-2026-121625","kind":"vulnerability","aliases":["CVE-2026-121625"],"related":[],"title":"GNU Gatekeeper: malformed RTCP packet reads heap memory and can crash gatekeeper","description":"GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in ParseRTCP() in ProxyChannel.cxx that allows remote RTP peers to read heap memory past received packets. Attackers can send RTCP SDES items lacking a NUL byte to the media proxy port during proxied H.323 calls with EnableRTCPStats enabled, crashing the gatekeeper.","summary":"GNU Gatekeeper (gnugk) before 5.16 has an out-of-bounds read in ParseRTCP() that lets a remote RTP peer read heap memory past received packets. A crafted RTCP SDES packet without a NUL byte can crash the gatekeeper.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gnugk","h323","runtime","self-hosted","voip"],"not_affected_if":["enablertcpstats-disabled","no-h323-proxy"],"how_to_check":"- Check the installed gnugk version against `5.16`.\n- Check whether `EnableRTCPStats` is enabled in the gatekeeper configuration; the sources say the issue needs it on.","fix":"- GNU Gatekeeper `5.16` or later (the sources name a patch and release notes for the fix; exact range not stated).","status":"open","published_at":"2026-11-03T18:17:58+00:00","first_seen_at":"2026-11-03T18:22:10+00:00","triaged_at":"2026-11-03T18:22:37+00:00","updated_at":"2026-11-03T18:22:37+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-03T18:22:37Z","model":"claude-haiku-5-5","output":{"fix":"- GNU Gatekeeper `5.16` or later (the sources name a patch and release notes for the fix; exact range not stated).","reach":"network","title":"GNU Gatekeeper: malformed RTCP packet reads heap memory and can crash gatekeeper","impact":"medium","summary":"GNU Gatekeeper (gnugk) before 5.16 has an out-of-bounds read in ParseRTCP() that lets a remote RTP peer read heap memory past received packets. A crafted RTCP SDES packet without a NUL byte can crash the gatekeeper.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["gnugk","h323","voip","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"gatekeeper crashes; heap memory past packets is readable","analyst_note":"Confirm the affected version range and the exact fixed release from the linked patch and release notes at github.com.","how_to_check":"- Check the installed gnugk version against `5.16`.\n- Check whether `EnableRTCPStats` is enabled in the gatekeeper configuration; the sources say the issue needs it on.\n- unknown beyond that.","plain_action":"","needs_analyst":true,"not_affected_if":["EnableRTCPStats-disabled","no-h323-proxy"],"who_is_affected":"Only deployments that proxy H.323 calls through gnugk with EnableRTCPStats turned on are described as exposed. A remote RTP peer able to reach the media proxy port can send the crafted packets, and the sources describe a crash rather than code execution.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000725,"input_tokens":4241,"output_tokens":602,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121625':15A,18A '-2026':14A,17A '5.16':30B,69C 'allow':83C 'attack':94C 'bound':36B,75C 'byte':60B,103C 'call':112C 'contain':70C 'craft':53B 'crash':11A,62B,116C 'cve':13A,16A 'enabl':115C 'enablertcpstat':114C 'gatekeep':2A,12A,27B,64B,66C,118C 'gnu':1A,26B,65C 'gnugk':19B,28B,67C 'h.323':111C 'h323':20B 'heap':7A,47B,89C 'host':24B 'item':99C 'lack':100C 'let':41B 'malform':3A 'media':106C 'memori':8A,48B,90C 'nul':59B,102C 'out-of-bound':33B,72C 'packet':5A,51B,56B,93C 'parsertcp':39B,79C 'past':49B,91C 'peer':45B,86C 'port':108C 'proxi':107C,110C 'proxychannel.cxx':81C 'read':6A,37B,46B,76C,88C 'receiv':50B,92C 'remot':43B,84C 'rtcp':4A,54B,97C 'rtp':44B,85C 'runtim':21B 'sdes':55B,98C 'self':23B 'self-host':22B 'send':96C 'voip':25B 'vulner':77C 'without':57B","nicknames":[],"mitigations":[],"who_affected":"Only deployments that proxy H.323 calls through gnugk with EnableRTCPStats turned on are described as exposed. A remote RTP peer able to reach the media proxy port can send the crafted packets, and the sources describe a crash rather than code execution.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gnugk","h323","medium","runtime","selfhosted","voip"],"campaign_type":null,"first_public_at":"2026-11-03T18:17:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121625","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121625","severity":null,"published_at":"2026-11-03T18:17:58+00:00","modified_at":"2026-11-03T18:17:58+00:00","first_seen_at":"2026-11-03T18:22:10+00:00","fetched_at":"2026-11-03T18:22:10+00:00","note":null}],"documents":[{"id":59643,"url":"https://github.com/willamowius/gnugk/commit/e8939d03b0b2ef46e356f3144a6ee14f2920b777","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":59644,"url":"https://github.com/willamowius/gnugk/releases/tag/v5_16","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":59645,"url":"https://www.vulncheck.com/advisories/gnu-gatekeeper-before-5.16-out-of-bounds-read-via-rtcp-sdes-parsing","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}