Summary
It was discovered that GStreamer Good Plugins did not limit the size of
reassembly buffers when processing fragmented RTP packets. A remote
attacker could possibly use this issue to cause GStreamer Good Plugins to
use excessive resources, leading to a denial of service.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | gst-plugins-good1.0 | 1.20.3-0ubuntu1.8 |
| Ubuntu · 24.04 LTS 24.04:LTS | gst-plugins-good1.0 | 1.24.2-1ubuntu1.6 |
| Ubuntu · 26.04 LTS 26.04:LTS | gst-plugins-good1.0 | 1.28.2-2ubuntu0.2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | gst-plugins-good1.0 | 1.8.3-1ubuntu0.5+esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | gst-plugins-good1.0 | 1.14.5-0ubuntu1~18.04.3+esm2 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | gst-plugins-good1.0 | 1.16.3-0ubuntu1.3+esm2 |
Vulnerabilities 1
-
High 7.5CVE-2026-18649 Public exploit
Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloaders
A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacke…
References
-
report
https://ubuntu.com/security/CVE-2026-18649