Summary
[1.26.7-2.3]
- Fix excessive memory allocation from malicious RTP fragmentation unit
packets in rtph264depay/rtph265depay (CVE-2026-18649)
Resolves: RHEL-224158
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | gstreamer1-plugins-good | 0:1.26.7-2.el10_2.3 |
| Oracle Linux · 10 | gstreamer1-plugins-good-gtk | 0:1.26.7-2.el10_2.3 |
Vulnerabilities 1
-
High 7.5CVE-2026-18649 Public exploit
Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloaders
A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacke…