CVE-2026-18649 Details

A denial-of-service vulnerability has been identified in the GStreamer gst-plugins-good package, specifically within the rtph264depay and rtph265depay RTP depayloader elements. These components fail to impose a maximum size limit on the reassembly buffer used when processing fragmented RTP packets. As a result, a remote, unauthenticated attacker can send an endless stream of RTP fragments without including an end-of-fragment marker, causing the reassembly buffer to expand indefinitely until the process runs out of memory. This unbounded memory growth leads to process termination.

Users can mitigate this vulnerability by employing SRTP or DTLS-SRTP to authenticate RTP packets before they reach the depayloaders. Alternatively, firewall rules can be used to restrict RTP traffic to trusted sources. Another option is to disable the RTP plugin entirely or prevent the affected depayloaders from being automatically selected in GStreamer pipelines.