{"id":"CVE-2026-125712","kind":"vulnerability","aliases":["CVE-2026-125712"],"related":[],"title":"GStreamer: malformed RTCP SDES packet lets a remote sender read memory","description":"A flaw was found in GStreamer's gst-plugins-base RTCP SDES packet parser. A remote sender able to reach an active media session can supply a malformed SDES entry whose declared length exceeds the received packet. Missing bounds validation can cause the receiver to read beyond the packet buffer, potentially crashing the application or exposing a limited amount of process memory.","summary":"GStreamer's gst-plugins-base RTCP SDES parser does not check that an entry's declared length fits in the received packet. A remote sender in an active media session can make the receiver read past its packet buffer, which may crash the application or expose a limited amount of process memory.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"gst-plugins-base","fixed":["1.28.4"],"affected":"< 1.28.4","ecosystem":"vendor"}],"ecosystems":[],"tags":["gst-plugins-base","gstreamer","media-servers","rtcp","rtp","runtime","webrtc"],"not_affected_if":["file-only-pipelines","no-live-rtp-sessions"],"how_to_check":"Run 'gst-inspect-1.0 --version' or 'pkg-config --modversion gstreamer-plugins-base-1.0'; gst-plugins-base below 1.28.4 is affected. Check distro packages (libgstreamer-plugins-base1.0) and bundled GStreamer in apps/containers. Most exposed: apps that receive RTP/RTCP from untrusted peers (webrtcbin, rtpbin, rtspsrc, media servers). Also check gst-plugins-good: a separate RTCP SDES PRIV bug (GStreamer-SA-2026-0091) is fixed only in 1.28.8.","fix":"Upgrade gst-plugins-base to 1.28.4 or later (upstream advisory; 1.28.9 is the latest 1.28 release). Older versions: apply the upstream patch and recompile.","status":"open","published_at":"2026-11-10T12:17:18+00:00","first_seen_at":"2026-11-10T12:21:54+00:00","triaged_at":"2026-11-10T12:22:32+00:00","updated_at":"2026-11-10T12:25:17+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-10T12:22:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"GStreamer: malformed RTCP SDES packet lets a remote sender read memory","impact":"medium","summary":"GStreamer's gst-plugins-base RTCP SDES parser does not check that an entry's declared length fits in the received packet. A remote sender in an active media session can make the receiver read past its packet buffer, which may crash the application or expose a limited amount of process memory.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["gstreamer","gst-plugins-base","rtp","webrtc","media-servers"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote peer crashes receiver or reads limited process memory","analyst_note":"Find affected and fixed gst-plugins-base versions and the upstream advisory from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-125712.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-live-rtp-sessions","file-only-pipelines"],"who_is_affected":"Applications that use GStreamer's gst-plugins-base RTP/RTCP handling to receive live media sessions are exposed, since a remote peer in that session can send the malformed SDES packet. Batch or file-only pipelines that never parse incoming RTCP are not reached. The sources do not name affected versions or a fixed release.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000729,"input_tokens":4568,"output_tokens":544,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected and fixed gst-plugins-base versions and the upstream advisory from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-125712.","search":"'-125712':14A,17A '-2026':13A,16A 'abl':105C 'activ':62B,109C 'amount':83B,146C 'applic':78B,141C 'base':21A,25B,39B,97C 'beyond':134C 'bound':126C 'buffer':73B,137C 'caus':129C 'check':45B 'crash':76B,139C 'cve':12A,15A 'declar':50B,119C 'entri':48B,117C 'exceed':121C 'expos':80B,143C 'fit':52B 'flaw':88C 'found':90C 'gst':19A,23B,37B,95C 'gst-plugins-bas':22B,36B,94C 'gst-plugins-base':18A 'gstreamer':1A,26B,34B,92C 'length':51B,120C 'let':6A 'limit':82B,145C 'make':66B 'malform':2A,115C 'may':75B 'media':28B,63B,110C 'media-serv':27B 'memori':11A,86B,149C 'miss':125C 'packet':5A,56B,72B,100C,124C,136C 'parser':42B,101C 'past':70B 'plugin':24B,38B,96C 'plugins':20A 'potenti':138C 'process':85B,148C 'reach':107C 'read':10A,69B,133C 'receiv':55B,68B,123C,131C 'remot':8A,58B,103C 'rtcp':3A,30B,40B,98C 'rtp':31B 'runtim':32B 'sdes':4A,41B,99C,116C 'sender':9A,59B,104C 'server':29B 'session':64B,111C 'suppli':113C 'valid':127C 'webrtc':33B 'whose':118C","nicknames":[],"mitigations":[],"who_affected":"Applications that use GStreamer's gst-plugins-base RTP/RTCP handling to receive live media sessions are exposed, since a remote peer in that session can send the malformed SDES packet. Batch or file-only pipelines that never parse incoming RTCP are not reached. The sources do not name affected versions or a fixed release.","tier":"B","verified":{"fix":{"at":"2026-11-10T12:25:17Z","by":"analyst","doc":"https://gstreamer.freedesktop.org/security/sa-2026-0030.html","run_id":2450},"products":{"at":"2026-11-10T12:25:17Z","by":"analyst","doc":"https://gstreamer.freedesktop.org/security/sa-2026-0030.html","run_id":2450}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["gstpluginsbase"],"ptokens":["base","gst","plugins"],"labels":["gstpluginsbase","gstreamer","high","mediaservers","rtcp","rtp","runtime","webrtc"],"campaign_type":null,"search_a":"'-125712':14A,17A '-2026':13A,16A 'base':21A 'cve':12A,15A 'gst':19A 'gst-plugins-base':18A 'gstreamer':1A 'let':6A 'malform':2A 'memori':11A 'packet':5A 'plugins':20A 'read':10A 'remot':8A 'rtcp':3A 'sdes':4A 'sender':9A","search_b":"'activ':62B 'amount':83B 'applic':78B 'base':25B,39B 'buffer':73B 'check':45B 'crash':76B 'declar':50B 'entri':48B 'expos':80B 'fit':52B 'gst':23B,37B 'gst-plugins-bas':22B,36B 'gstreamer':26B,34B 'length':51B 'limit':82B 'make':66B 'may':75B 'media':28B,63B 'media-serv':27B 'memori':86B 'packet':56B,72B 'parser':42B 'past':70B 'plugin':24B,38B 'process':85B 'read':69B 'receiv':55B,68B 'remot':58B 'rtcp':30B,40B 'rtp':31B 'runtim':32B 'sdes':41B 'sender':59B 'server':29B 'session':64B 'webrtc':33B","search_c":"'abl':105C 'activ':109C 'amount':146C 'applic':141C 'base':97C 'beyond':134C 'bound':126C 'buffer':137C 'caus':129C 'crash':139C 'declar':119C 'entri':117C 'exceed':121C 'expos':143C 'flaw':88C 'found':90C 'gst':95C 'gst-plugins-bas':94C 'gstreamer':92C 'length':120C 'limit':145C 'malform':115C 'media':110C 'memori':149C 'miss':125C 'packet':100C,124C,136C 'parser':101C 'plugin':96C 'potenti':138C 'process':148C 'reach':107C 'read':133C 'receiv':123C,131C 'remot':103C 'rtcp':98C 'sdes':99C,116C 'sender':104C 'session':111C 'suppli':113C 'valid':127C 'whose':118C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T12:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125712","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125712","severity":null,"published_at":"2026-11-10T12:17:18+00:00","modified_at":"2026-11-10T12:17:18+00:00","first_seen_at":"2026-11-10T12:21:54+00:00","fetched_at":"2026-11-10T12:21:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125712:2450","url":"https://gstreamer.freedesktop.org/security/sa-2026-0030.html","severity":null,"published_at":"2026-11-10T12:25:17+00:00","modified_at":"2026-11-10T12:25:17+00:00","first_seen_at":"2026-11-10T12:25:17+00:00","fetched_at":"2026-11-10T12:25:17+00:00","note":"Upstream advisory GStreamer-SA-2026-0030 (affected <1.28.4, fixed 1.28.4, published 2026-06-12) matches this CVE's description (RTCP SDES OOB read in gst-plugins-base), but the advisory says 'No CVE number assigned', so the mapping is by description only; Red Hat is the CNA. NVD page unreadable; Rapid7 mirrors Red Hat text (CVSS 8.2). No exploitation or PoC found; X not searched, web-cli search worked. Verified only fix/products from the vendor page.","cites":["https://gstreamer.freedesktop.org/security/sa-2026-0030.html","https://www.rapid7.com/db/vulnerabilities/cve-2026-125712/"]}],"documents":[{"id":114953,"url":"https://gstreamer.freedesktop.org/security/sa-2026-0030.html","title":"GStreamer-SA-2026-0030: Missing bounds checks in RTCP SDES packet parsing","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":114954,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-125712/","title":"Rapid7: CVE-2026-125712 (Red Hat description)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}