GNU Gatekeeper EUVD-2026-116101

Exploitation requires that the target gatekeeper be using H.460.24 NAT traversal and that an H.460.24 probing exchange be in progress; the attacker sends a short application-defined RTCP packet to the media port during that probe, and the pre-fix code copies 20 bytes from offset 12 with no minimum-length check, reading past the heap allocation. Limiting factors that reduce realistic risk: the attack is network-based and unauthenticated (PR:N) but carries high complexity (AC:H) and a timing/probe precondition (AT:P in CVSS 4.0), so it cannot be triggered against an idle service - a probing session must be active and the packet must reach the correct media port; realistic impact is confined to a possible crash (availability) rather than data disclosure or code execution.

This is a medium-severity, lower-priority issue rather than an urgent threat. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) scores 6.3 and shows the two signals that constrain real-world risk: AC:H and AT:P mean exploitation is network-reachable and unauthenticated but depends on specific conditions and timing - the attacker must send the malformed probe to the media port while an H.460.24 probing exchange is actually taking place, not against an idle service. Impact is limited to availability (VA:L only; VC:N, VI:N) - the description's worst case is reading past the heap allocation and 'possibly' crashing the gatekeeper, i.e. a potential denial of service, not reliable data disclosure or code execution. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no public exploit was provided, so there is no evidence of active or imminent exploitation. The vuln.today decision label is 'this_month', consistent with applying the vendor fix in a normal monthly patch cycle rather than as an emergency. One cross-source tension to verify: the input Tags include 'Information Disclosure', but the authoritative CVSS 4.0 vector sets VC:N (no confidentiality impact), so the practical risk is a crash/DoS, not confirmed data leakage.

An attacker who can reach a GNU Gatekeeper media port sends a short, malformed application-defined RTCP packet during an H.460.24 NAT-traversal probing exchange. The undersized packet causes ReceivedProbePacket() to read past the end of the heap buffer (the code copied 20 bytes from offset 12 without first checking the frame was at least 32 bytes), potentially crashing the gatekeeper and disrupting VoIP call setup. No public exploit was identified at time of analysis, and the high attack complexity (AC:H) with a timing/probing precondition (AT:P) makes reliable triggering non-trivial.