EUVD-2026-53768
GHSA-wr93-5xph-995g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted fragmented H.264/H.265 RTP packets
-
DeliveryWithhold end-of-fragment marker indefinitely
-
ExploitTrigger unbounded reassembly buffer growth
-
ExecutionExhaust process memory allocation
-
PersistOS OOM killer terminates GStreamer process
-
ImpactDenial of service achieved
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target application uses GStreamer's rtph264depay or rtph265depay elements in its active pipeline and that the attacker can deliver RTP UDP or TCP packets to the port on which the application is listening. No authentication is required (CVSS PR:N) and no user interaction is needed (CVSS UI:N). The limiting factors are: the application must be actively processing RTP H.264 or H.265 streams (not other codecs or transport protocols), and the attacker must have network-level reachability to the RTP listening port. Applications that process RTP only from authenticated or trusted sources, or that sit behind strict network controls admitting only trusted senders, face substantially reduced risk. There is no requirement for a non-default configuration - the flaw is in the default reassembly logic of the depayloader elements. |
| Impact | The CVSS 7.5 score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects real-world risk: this is a low-complexity, unauthenticated network-reachable denial-of-service with no special conditions required beyond the ability to deliver RTP packets to the target. The availability impact is high because process termination disrupts the entire application, not just a single stream. No EPSS score was provided in the input data; without it, exploitation probability cannot be quantified. No KEV listing and no documented POC code moderate urgency - this is a genuine architectural defect rather than a targeted exploit in circulation. The primary real-world risk is in media servers, video surveillance systems, VoIP gateways, and conferencing infrastructure that accept RTP streams from untrusted network sources. There is no confidentiality or integrity risk, which is consistent with the description. CVSS and description are fully aligned - no conflicting signals to flag. |
| Exploit ScenarioDerived | An attacker targets a publicly accessible video conferencing server or IP camera recording system built on GStreamer. They connect to the RTP port and transmit a continuous stream of fragmented H.264 RTP packets (FU-A units with the start bit set but the end bit never set), causing the rtph264depay reassembly buffer to consume all available process memory within seconds to minutes depending on available RAM. The GStreamer process is then terminated by the OS OOM killer, dropping all active video sessions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 06, 2026
Unbounded memory growth in GStreamer's RTP H.264 and H.265 depayloader elements allows a remote unauthenticated attacker to exhaust process memory and terminate any application consuming RTP video streams. The rtph264depay and rtph265depay elements in gst-plugins-good lack an upper bound on their internal reassembly buffer, meaning an attacker who continuously sends fragmented RTP packets while withholding the end-of-fragment marker can grow that buffer without limit. No public exploit has been identified at time of analysis, and CISA KEV listing is absent, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is trivially exploitable against any exposed GStreamer RTP pipeline.
RemediationAI
The primary remediation is to apply the vendor-supplied patch once released by Red Hat for RHEL 7, 8, 9, and 10 via the standard errata process; monitor https://access.redhat.com/security/cve/CVE-2026-18649 for errata availability. An upstream fix exists as GStreamer Security merge request #113 at https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/113, but a tagged release version incorporating this fix has not been independently confirmed from available data, so 'upstream fix available (PR/commit); released patched version not independently confirmed' is the correct patch status. Until a patch is applied, compensating controls should target the attack surface directly: restrict RTP ingress to trusted source IP ranges at the network perimeter or host firewall, reducing exposure to untrusted senders. Applications that do not require H.264 or H.265 RTP input should disable or remove the rtph264depay and rtph265depay elements from their GStreamer pipelines. Enforcing OS-level memory limits (ulimit -v or systemd MemoryMax) on the GStreamer process will bound the damage to a single process crash rather than full host memory exhaustion, at the cost of potentially terminating legitimate streams under high load.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GStreamer's gst-plugins-good provides RTP depayloader elements (rtph264depay, rtph265depay) that reconstruct fragmented RTP payloads carrying H.264 and H.265 compressed video before passing them downstream for decoding. RTP fragmentation is standard in video streaming - large NAL units are split across multiple RTP packets and reassembled at the receiver using a start/continuation/end bit scheme. The flaw (CWE-770: Allocation of Resources Without Limits or Throttling) is the complete absence of a size ceiling on the internal reassembly buffer. Because the code only completes and flushes the buffer upon receiving an end-of-fragment marker, an attacker who never sends that marker causes indefinite buffer accumulation. Affected deployments are documented in CPE as the gst-plugins-good package across Red Hat Enterprise Linux 7, 8, 9, and 10 (cpe:2.3:a:red_hat:red_hat_enterprise_linux_{7,8,9,10}).
Know when Red Hat Enterprise Linux 10 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable with no auth or interaction required; impact is process termination only, no confidentiality or integrity loss.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacker can send a continuous stream of RTP fragments without ever transmitting an end-of-fragment marker, causing the reassembly buffer to grow without bound until process memory is exhausted. This results in a denial of service through process termination.
Executive ViewAI
GStreamer's gst-plugins-good RTP video depayloaders (rtph264depay and rtph265depay) contain an unbounded memory allocation flaw that allows unauthenticated remote attackers to crash video applications and disrupt streaming services across organizations. While no public exploit has been identified at time of analysis, the vulnerability remains trivially exploitable via network access, and with no vendor-released patch identified at time of analysis, enterprises must implement network controls and input validation to prevent exploitation.
Network segmentation restricting RTP traffic to authenticated trusted sources; rate-limiting on fragmented RTP packet ingestion; disabling RTP video depayloading if not operationally required; deployment of RTP pipelines behind reverse proxies or firewalls implementing packet-level validation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Exploit-DB