GStreamer rtpL16depay EUVD-2026-107395

Exploitation requires the target application or GStreamer pipeline to actually use the rtpL16depay element to depayload attacker-supplied RTP L16 (16-bit linear PCM) audio, and the attacker must be able to deliver that RTP stream to the pipeline. Limiting factors: only GStreamer-based software that processes RTP L16 audio is affected (not every GStreamer deployment instantiates this element); the description explicitly states interaction with the library is required and that attack vectors vary by implementation, so a passive RTP receiver/server is effectively remotely exploitable while a client application may require a user to connect to or open a malicious stream. Code execution occurs only at the privilege level of the process hosting the pipeline.

Multiple signals point toward genuine high priority, but with one notable caveat. The CVSS 3.0 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with full CIA impact (9.8 CRITICAL), and the CWE-122 heap overflow with stated 'execute arbitrary code' impact is consistent with a high-technical-impact, memory-corruption RCE. This was reported through ZDI (ZDI-CAN-31143 / ZDI-26-775), a credible research source, and a vendor fix commit already exists in the GStreamer GitLab, which confirms the bug is real and patched. However, no EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no evidence of active exploitation or weaponization - the risk is driven by severity and reachability, not by observed in-the-wild use. One explicit conflict must be flagged: the CVSS vector asserts UI:N (no user interaction), yet the description states 'Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.' This means real-world exploitability is implementation-dependent - straightforward (effectively UI:N) for a server/pipeline that passively receives RTP L16 streams, but gated by user action for a client that must be pointed at a malicious stream. Verify the deployment mode before treating this as universally unauthenticated-remote.

An attacker delivers a crafted RTP L16 audio stream to an application built on GStreamer whose pipeline uses the rtpL16depay element; the depayloader copies attacker-controlled payload data into a heap buffer without validating its length, overflowing it. By shaping the oversized payload the attacker corrupts heap metadata or adjacent objects to achieve arbitrary code execution in the context of the processing application. No public proof-of-concept was identified in the provided data, so exploitation currently requires original exploit development.