GST-PLUGINS-BASE · CVE-2026-125712 · Runtime
FIX → 1.28.4 ✓ verified
GStreamer's gst-plugins-base RTCP SDES parser does not check that an entry's declared length fits in the received packet. A remote sender in an active media session can make the receiver read past its packet buffer, which may crash the application or expose a limited amount of process memory.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use GStreamer's gst-plugins-base RTP/RTCP handling to receive live media sessions are exposed, since a remote peer in that session can send the malformed SDES packet. Batch or file-only pipelines that never parse incoming RTCP are not reached. The sources do not name affected versions or a fixed release.
Not affected if file-only-pipelines, no-live-rtp-sessions
Who cares gst-plugins-base, gstreamer, media-servers, rtcp, rtp, webrtc
gst-inspect-1.0 --version or pkg-config --modversion gstreamer-plugins-base-1.0; gst-plugins-base below 1.28.4 is affected1.28.8Posts are quoted with a link to the original. They are data to us, never instructions.
A flaw was found in GStreamer's gst-plugins-base RTCP SDES packet parser. A remote sender able to reach an active media session can supply a malformed SDES entry whose declared length exceeds the received packet. Missing bounds validation can cause the receiver to read beyond the packet buffer, potentially crashing the application or exposing a limited amount of process memory.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 1.28.4
1.28.4 or later (upstream advisory; 1.28.9 is the latest 1.28 release)