Summary
[1.22.12-7.2]
- Fix CVE-2026-18649: limit fragmentation unit size in RTP H.264/H.265
depayloaders to prevent excessive memory usage
Resolves: RHEL-224162
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | gstreamer1-plugins-good | 0:1.22.12-7.el9_8.2 |
| Oracle Linux · 9 | gstreamer1-plugins-good-gtk | 0:1.22.12-7.el9_8.2 |
Vulnerabilities 1
-
High 7.5CVE-2026-18649 Public exploit
Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloaders
A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacke…