GStreamer CVE-2026-18299

Exploitation requires that a GStreamer-based application on the target system is actively processing an RTP stream that carries SBC-encoded audio through the rtpsbcdepay pipeline element. User interaction is required (CVSS UI:R): the targeted user must open or otherwise trigger processing of the crafted RTP/SBC content, such as by opening a malicious media file, accepting a VoIP call, or pairing with a malicious Bluetooth audio source. No authentication or elevated privileges are required to deliver the malicious payload (PR:N), but access to a channel by which the crafted RTP stream reaches the vulnerable application is necessary. Exploitation is limited by the local attack vector (AV:L) - the flaw triggers inside the media pipeline process rather than through direct network service exploitation. Systems that do not use GStreamer for RTP/SBC processing, or that restrict media input to trusted internal sources, are not exposed.

The CVSS 3.0 score of 7.8 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects full confidentiality, integrity, and availability impact within the vulnerable process, but scope is unchanged and user interaction is mandatory. The AV:L metric warrants attention: despite the description characterizing this as affecting 'remote attackers,' AV:L is consistent with how media library use-after-frees typically operate - the attacker delivers malicious content remotely, but exploitation fires locally inside the media-processing application. This limits the attack surface to scenarios where a user actively processes untrusted RTP/SBC input. No EPSS score was provided, so exploitation probability cannot be quantified; no CISA KEV listing is present, meaning active exploitation is not confirmed. ZDI's coordinated disclosure model implies the flaw was reproducibly exploited in a controlled environment, elevating confidence in exploitability. Real-world priority should be weighted by whether the deployment consumes RTP/SBC streams from untrusted or internet-facing sources - for such deployments, the practical risk exceeds what AV:L alone suggests.

An attacker crafts a malformed RTP stream with an SBC audio payload engineered to trigger the use-after-free condition in GStreamer's rtpsbcdepay element. The attacker delivers this stream to a target user - via a malicious web page embedding a media player, a crafted Bluetooth audio source, or a manipulated SDP offer in a VoIP session - causing the victim's GStreamer-based application to process the payload and dereference a freed object. Successful exploitation executes attacker-supplied shellcode in the context of the media-processing application process, inheriting its privileges and file system access.