{"id":"CVE-2026-121626","kind":"vulnerability","aliases":["CVE-2026-121626"],"related":[],"title":"GNU Gatekeeper: short probe packet causes heap over-read and possible crash","description":"GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in H46024Socket::ReceivedProbePacket() that allows remote attackers to cause a heap over-read by sending short probe packets. Attackers can send a short application-defined RTCP packet to the media port during H.460.24 probing to read past the heap allocation and possibly crash the gatekeeper.","summary":"GNU Gatekeeper (gnugk) before 5.16 has an out-of-bounds read in its H.460.24 probing code, triggered by a short RTCP packet sent to the media port. A remote attacker can read past a heap allocation and possibly crash the gatekeeper.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gnugk","h323","infrastructure","self-hosted","voip"],"not_affected_if":["gnugk-5.16-or-later","h460-24-disabled"],"how_to_check":"- Check the installed gnugk version against the fixed release (`gnugk --version` or the package manager's version query).\n- Confirm whether H.460.24 probing is enabled in the gatekeeper configuration; unknown whether the sources name the exact setting.","fix":"- GNU Gatekeeper: upgrade to `5.16` or later (per the sources' 'before 5.16' range).","status":"open","published_at":"2026-11-03T18:17:58+00:00","first_seen_at":"2026-11-03T18:22:10+00:00","triaged_at":"2026-11-03T18:22:37+00:00","updated_at":"2026-11-03T18:22:37+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-03T18:22:37Z","model":"claude-haiku-5-5","output":{"fix":"- GNU Gatekeeper: upgrade to `5.16` or later (per the sources' 'before 5.16' range).","reach":"internet","title":"GNU Gatekeeper: short probe packet causes heap over-read and possible crash","impact":"medium","summary":"GNU Gatekeeper (gnugk) before 5.16 has an out-of-bounds read in its H.460.24 probing code, triggered by a short RTCP packet sent to the media port. A remote attacker can read past a heap allocation and possibly crash the gatekeeper.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["gnugk","voip","h323","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Heap memory is over-read, possibly crashing the gatekeeper process","analyst_note":"","how_to_check":"- Check the installed gnugk version against the fixed release (`gnugk --version` or the package manager's version query).\n- Confirm whether H.460.24 probing is enabled in the gatekeeper configuration; unknown whether the sources name the exact setting.","plain_action":"","needs_analyst":false,"not_affected_if":["gnugk-5.16-or-later","h460-24-disabled"],"who_is_affected":"Operators running GNU Gatekeeper before 5.16 that accept H.323 traffic and use H.460.24 probing on the media port are exposed. The flaw is reachable remotely by sending short probe packets, so internet-facing or untrusted-network gatekeepers are the priority. Deployments without H.460.24 or that are not reachable from untrusted networks can deprioritize it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00073,"input_tokens":4213,"output_tokens":617,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121626':16A,19A '-2026':15A,18A '5.16':31B,73C 'alloc':63B,123C 'allow':86C 'applic':107C 'application-defin':106C 'attack':57B,88C,101C 'bound':37B,79C 'caus':6A,90C 'code':43B 'contain':74C 'crash':13A,66B,126C 'cve':14A,17A 'defin':108C 'gatekeep':2A,28B,68B,70C,128C 'gnu':1A,27B,69C 'gnugk':20B,29B,71C 'h.460.24':41B,116C 'h323':21B 'h46024socket':83C 'heap':7A,62B,92C,122C 'host':25B 'infrastructur':22B 'media':53B,113C 'out-of-bound':34B,76C 'over-read':8A,93C 'packet':5A,49B,100C,110C 'past':60B,120C 'port':54B,114C 'possibl':12A,65B,125C 'probe':4A,42B,99C,117C 'read':10A,38B,59B,80C,95C,119C 'receivedprobepacket':84C 'remot':56B,87C 'rtcp':48B,109C 'self':24B 'self-host':23B 'send':97C,103C 'sent':50B 'short':3A,47B,98C,105C 'trigger':44B 'voip':26B 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Operators running GNU Gatekeeper before 5.16 that accept H.323 traffic and use H.460.24 probing on the media port are exposed. The flaw is reachable remotely by sending short probe packets, so internet-facing or untrusted-network gatekeepers are the priority. Deployments without H.460.24 or that are not reachable from untrusted networks can deprioritize it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gnugk","h323","infrastructure","medium","selfhosted","voip"],"campaign_type":null,"first_public_at":"2026-11-03T18:17:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121626","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121626","severity":null,"published_at":"2026-11-03T18:17:58+00:00","modified_at":"2026-11-03T18:17:58+00:00","first_seen_at":"2026-11-03T18:22:10+00:00","fetched_at":"2026-11-03T18:22:10+00:00","note":null}],"documents":[{"id":59646,"url":"https://github.com/willamowius/gnugk/commit/160aa27344ecc9a443cccaa63e8d7fa95a766610","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":59644,"url":"https://github.com/willamowius/gnugk/releases/tag/v5_16","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":59648,"url":"https://www.vulncheck.com/advisories/gnu-gatekeeper-before-5.16-out-of-bounds-read-in-h-460.24-rtcp-probe-handler","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}