GNU Gatekeeper CVE-2026-121625

Exploitation requires that gnugk be actively media-proxying an H.323 call AND that the non-default EnableRTCPStats option be enabled; without RTCP stats processing the vulnerable ParseRTCP() SDES path is not reached. The attacker must be able to send RTCP to the media proxy port as a peer of an in-progress proxied call, and the crafted RTCP SDES item must lack a terminating NUL byte so the length-based read runs past the received packet. Limiting factors that reduce real-world risk: the EnableRTCPStats configuration dependency (not on by default), the need for a live proxied call to exist at the time of attack, and the requirement that the gatekeeper actually proxy the media stream rather than only signalling - together these are why the vendor rates attack complexity high (AC:H) and an attack requirement present (AT:P).

This is a medium-severity denial-of-service issue (vendor CVSS 4.0 base 6.3), and the available signals converge on 'important but not emergency.' The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) correctly captures that the attack is network-reachable and needs no authentication to gnugk, but is gated by real conditions: AC:H and AT:P reflect that exploitation requires an in-progress, media-proxied H.323 call and the non-default EnableRTCPStats option. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with the absence of a KEV listing. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quoted. There is no public exploit identified at time of analysis - the references contain the fix commit, the v5.16 release, a pointer to the vulnerable source lines, and the VulnCheck advisory, but none of these is confirmed working exploit code. The input/vendor models impact as confidentiality-none, availability-low (VA:L), which conflicts with the description's wording 'crashing the gatekeeper' - a full process crash is better characterized as a high availability impact, so my independent assessment rates availability higher than the vendor (see assessed vectors). Despite the 'Information Disclosure' tag and the heap-over-read mechanism, VC:N is appropriate because the out-of-bounds bytes are stored into SDES call statistics rather than returned to the attacker. Net: a legitimate patch-this-month DoS risk for exposed proxies running RTCP stats, not a high-CVSS-but-no-real-risk item and not a drop-everything emergency.

During an H.323 call that gnugk is media-proxying with EnableRTCPStats enabled, a malicious or compromised RTP peer sends a crafted RTCP SDES packet whose SDES item is not NUL-terminated to the media proxy port. ParseRTCP() in ProxyChannel.cxx reads heap memory past the end of the received packet, which crashes the gatekeeper process and drops service. No public exploit was identified at time of analysis; only the fix commit and vendor advisory are referenced.