EUVD-2026-42051
GHSA-m678-vwg3-59mp
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Network vector requires MitM on signaling (AC:H); no auth needed; only integrity weakened, no confidentiality or availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto() function contains an inverted boolean condition that causes it to accept remote SDP offers or answers that lack the required a=fingerprint attribute, while incorrectly rejecting those that include it. An attacker with the ability to intercept and modify WebRTC signaling messages could exploit this to bypass the SDP-level DTLS certificate fingerprint binding, weakening defenses against man-in-the-middle attacks on media streams.
AnalysisAI
GStreamer's webrtcbin component accepts remote SDP offers and answers that are missing the required a=fingerprint attribute due to an inverted boolean logic check in _check_sdp_crypto(), undermining the DTLS certificate fingerprint binding that protects WebRTC media streams from interception. An attacker already positioned as a man-in-the-middle on the WebRTC signaling channel can strip the a=fingerprint attribute from SDP messages, which the vulnerable code then incorrectly accepts, allowing the attacker to substitute their own DTLS certificate and intercept or tamper with encrypted media. No public exploit code exists and no CISA KEV listing has been issued; however, the flaw is architecturally significant because it silently voids a key WebRTC security guarantee rather than causing an obvious crash.
Technical ContextAI
WebRTC sessions negotiate cryptographic parameters through the Session Description Protocol (SDP), where the a=fingerprint attribute cryptographically binds the DTLS certificate used to encrypt media to the signaling exchange. Without this binding, an adversary who controls the signaling path can substitute a different certificate undetected. GStreamer is an open-source multimedia pipeline framework; its webrtcbin plugin provides WebRTC functionality on Linux and other platforms, including Red Hat Enterprise Linux 6 through 10 (CPE cpe:2.3:a:red_hat:red_hat_enterprise_linux_*). The root cause is CWE-670 (Always-Incorrect Control Flow Implementation): the _check_sdp_crypto() function uses an inverted conditional, meaning the presence of a=fingerprint causes rejection while its absence causes acceptance - the exact opposite of the intended security check. This is a pure logic error, not a memory-safety issue.
RemediationAI
An upstream fix has been submitted via GStreamer's security merge request at https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/98; however, a specific tagged release version incorporating this fix was not confirmed in the available data, so this should be characterized as an upstream fix available (MR/commit) with released patched version not independently confirmed. RHEL users should monitor https://access.redhat.com/security/cve/CVE-2026-14935 and https://bugzilla.redhat.com/show_bug.cgi?id=2497679 for updated RPM packages and apply vendor-released patches as soon as they are available. As a compensating control prior to patching, organizations should enforce TLS/HTTPS or another authenticated transport for WebRTC signaling (e.g., WSS WebSocket) to eliminate the MitM prerequisite that this flaw requires - this does not fix the bug but removes the attacker's ability to intercept and modify SDP messages. Applications that cannot be patched immediately should additionally consider enabling application-layer certificate pinning at the media layer if their WebRTC stack supports it, though this adds operational complexity for certificate rotation.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today