GStreamer webrtcbin CVE-2026-14935

Exploitation requires the attacker to hold an active man-in-the-middle position on the WebRTC signaling channel - specifically, the ability to intercept and modify SDP offer/answer messages in transit. This is the single mandatory precondition stated in the description. The CVSS vector PR:N confirms no authentication to the target system is required once signaling access is obtained. The flaw is present in webrtcbin regardless of whether the application enforces DTLS-SRTP, because the bypass occurs before DTLS negotiation at the SDP validation layer. Exploitation is limited by: (1) the attacker must control or intercept the signaling path, not merely be on the same network; (2) AC:H reflects that this MitM position is not trivially achieved over encrypted signaling transports (WSS/TLS); (3) the scope is restricted to active WebRTC sessions using GStreamer webrtcbin - passive or non-WebRTC deployments are unaffected.

The NVD CVSS 3.1 score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately reflects the constrained real-world risk. The AC:H metric is the dominant limiting factor: exploiting this flaw requires the attacker to already hold a man-in-the-middle position on the WebRTC signaling channel - a non-trivial prerequisite that significantly narrows the attack surface. The direct integrity impact is scored Low (I:L) because the vulnerability weakens a defense-in-depth control rather than directly leaking or corrupting data; however, a successful exploit could escalate to full media stream interception, which the CVSS base score does not capture. No EPSS data was included in the provided intelligence; KEV status is negative; no POC code has been identified at time of analysis. In practice, this is a meaningful security regression in WebRTC-dependent applications (VoIP, video conferencing) running on RHEL, but the MitM signaling prerequisite prevents mass automated exploitation. Organizations operating GStreamer-based WebRTC endpoints on untrusted networks or over unencrypted signaling transports face higher effective risk than the raw score suggests.

An attacker positioned between a GStreamer-based WebRTC endpoint and its signaling server - for example, via ARP poisoning on a local network or by controlling a compromised signaling relay - intercepts outgoing SDP offers and strips the a=fingerprint attribute before forwarding them. Because _check_sdp_crypto() has its conditional inverted, the receiving endpoint's GStreamer instance accepts the fingerprint-free SDP as valid. The attacker can now present their own DTLS certificate during media negotiation without detection, enabling decryption and replay of the media stream. No public proof-of-concept code has been identified.