Description
A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacker can send a continuous stream of RTP fragments without ever transmitting an end-of-fragment marker, causing the reassembly buffer to grow without bound until process memory is exhausted. This results in a denial of service through process termination.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gst-plugins-good1.0 | 1.28.6-1 | — |
| Debian 13 | gst-plugins-good1.0 | No fix yet | — |
| Debian 12 | gst-plugins-good1.0 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | gst-plugins-good1.0 | 1.28.2-2ubuntu0.2 | USN-8778-1 |
| Ubuntu 24.04 LTS | gst-plugins-good1.0 | 1.24.2-1ubuntu1.6 | USN-8778-1 |
| Ubuntu 22.04 LTS | gst-plugins-good1.0 | 1.20.3-0ubuntu1.8 | USN-8778-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | gst-plugins-good1.0 | 1.16.3-0ubuntu1.3+esm2 | USN-8778-1 |
| Ubuntu Pro 18.04 LTS | gst-plugins-good1.0 | 1.14.5-0ubuntu1~18.04.3+esm2 | USN-8778-1 |
| Ubuntu Pro 16.04 LTS | gst-plugins-good1.0 | 1.8.3-1ubuntu0.5+esm2 | USN-8778-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | gstreamer1-plugins-good +1 | 1.26.7-2.el10_2.3 | RHSA-2026:53451 |
| RHEL 9 | gstreamer1-plugins-good +1 | 1.22.12-7.el9_8.2 | RHSA-2026:53452 |
| RHEL 8 | gstreamer1-plugins-good +1 | 1.16.1-7.el8_10.3 | RHSA-2026:56966 |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | gstreamer1-plugins-good +1 | 1.24.11-1.el10_0.4 | RHSA-2026:65959 |
| RHEL 9.6 EUS | gstreamer1-plugins-good +1 | 1.22.12-5.el9_6.2 | RHSA-2026:61943 |
| RHEL 9.4 E4S | gstreamer1-plugins-good +1 | 1.22.1-4.el9_4.2 | RHSA-2026:61588 |
| RHEL 9.2 E4S | gstreamer1-plugins-good +1 | 1.18.4-8.el9_2.2 | RHSA-2026:65999 |
| RHEL 8.8 TUS | gstreamer1-plugins-good +1 | 1.16.1-5.el8_8.3 | RHSA-2026:69232 |
| RHEL 8.8 E4S | gstreamer1-plugins-good +1 | 1.16.1-5.el8_8.3 | RHSA-2026:69232 |
| RHEL 8.6 EUS Long Life | gstreamer1-plugins-good +1 | 1.16.1-4.el8_6.3 | RHSA-2026:70584 |
| RHEL 8.6 AUS | gstreamer1-plugins-good +1 | 1.16.1-4.el8_6.3 | RHSA-2026:70584 |
| RHEL 8.4 EUS Long Life | gstreamer1-plugins-good +1 | 1.16.1-4.el8_4.2 | RHSA-2026:70803 |
| RHEL 8.4 AUS | gstreamer1-plugins-good +1 | 1.16.1-4.el8_4.2 | RHSA-2026:70803 |
| RHEL 7 ELS | gstreamer1-plugins-good | 1.10.4-4.el7_9.3 | RHSA-2026:70264 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | gstreamer1-plugins-good +1 | 1.26.7-2.el10_2.3 | ALSA-2026:53451 |
| AlmaLinux 9 | gstreamer1-plugins-good +1 | 1.22.12-7.el9_8.2 | ALSA-2026:53452 |
| AlmaLinux 8 | gstreamer1-plugins-good +1 | 1.16.1-7.el8_10.3 | ALSA-2026:56966 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | gstreamer1-plugins-good | 1.26.7-2.el10_2.3 | RLSA-2026:53451 |
| Rocky Linux 9 | gstreamer1-plugins-good | 1.22.12-7.el9_8.2 | RLSA-2026:53452 |
| Rocky Linux 8 | gstreamer1-plugins-good | 1.16.1-7.el8_10.3 | RLSA-2026:56966 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | gstreamer1-plugins-good +1 | 1.24.10-1.amzn2023.0.8 | ALAS2023-2026-2121 |
| Amazon Linux 2 | gstreamer-plugins-good +1 | 0.10.31-20.amzn2.0.5 | ALAS2-2026-3898 |
| Amazon Linux 2 | gstreamer1-plugins-good +1 | 1.18.4-6.amzn2.0.13 | ALAS2-2026-3899 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | gstreamer1-plugins-good +1 | 1.26.7-2.el10_2.3 | ELSA-2026-53451 |
| Oracle Linux 9 | gstreamer1-plugins-good +1 | 1.22.12-7.el9_8.2 | ELSA-2026-53452 |
| Oracle Linux 8 | gstreamer1-plugins-good +1 | 1.16.1-7.el8_10.3 | ELSA-2026-56966 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 2 repositories
-
0xSemizzz/CVE-2026-18649 ★ 4 · Aug 6, 2026
Proof of concept for CVE-2026-18649, a remote denial of service vulnerability in GStreamer's H.264 RTP depayloader (rtph264depay).
-
C3viche/cve-2026-18649 ★ 0 · Oct 31, 2026
GStreamer RTP Depayloader Memory Exhaustion Analysis
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 25
- RHSA-2026:69232 Red Hat Security Advisory: gstreamer1-plugins-good security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-2662 GStreamer: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 5, 2026
- ALSA-2026:53452 Moderate: gstreamer1-plugins-good security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:53451 Moderate: gstreamer1-plugins-good security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:56966 Moderate: gstreamer1-plugins-good security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:70803 Red Hat Security Advisory: gstreamer1-plugins-good security update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2026:70584 Red Hat Security Advisory: gstreamer1-plugins-good security update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2026:70264 Red Hat Security Advisory: gstreamer1-plugins-good security update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2026:65999 Red Hat Security Advisory: gstreamer1-plugins-good security update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2026:65959 Red Hat Security Advisory: gstreamer1-plugins-good security update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2026:61943 Red Hat Security Advisory: gstreamer1-plugins-good security update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2026:61588 Red Hat Security Advisory: gstreamer1-plugins-good security update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2026:56966 Red Hat Security Advisory: gstreamer1-plugins-good security update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2026:53451 Red Hat Security Advisory: gstreamer1-plugins-good security update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2026:53452 Red Hat Security Advisory: gstreamer1-plugins-good security update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- USN-8778-1 gst-plugins-good1.0 vulnerability Ubuntu Security Notices (USN) · Sep 18, 2026
- ALAS2-2026-3899 Important: gstreamer1-plugins-good security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 15, 2026
- ALAS2023-2026-2121 Important: gstreamer1-plugins-good security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 15, 2026
- ALAS2-2026-3898 Important: gstreamer-plugins-good security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 31, 2026
- RLSA-2026:56966 Moderate: gstreamer1-plugins-good security update Rocky Linux Security Advisories · Aug 20, 2026
- ELSA-2026-56966 Moderate: gstreamer1-plugins-good security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 19, 2026
- RLSA-2026:53451 Moderate: gstreamer1-plugins-good security update Rocky Linux Security Advisories · Aug 12, 2026
- RLSA-2026:53452 Moderate: gstreamer1-plugins-good security update Rocky Linux Security Advisories · Aug 12, 2026
- ELSA-2026-53452 Moderate: gstreamer1-plugins-good security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 11, 2026
- ELSA-2026-53451 Moderate: gstreamer1-plugins-good security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Aug 11, 2026
References
- https://0xsemizzz.vercel.app/projects/cve-2026-18649-gstreamer-rtp-dos/
- RHSA-2026:53451 vendor-advisory
- RHSA-2026:53452 vendor-advisory
- RHSA-2026:56966 vendor-advisory
- RHSA-2026:61588 vendor-advisory
- RHSA-2026:61943 vendor-advisory
- RHSA-2026:65959 vendor-advisory
- RHSA-2026:65999 vendor-advisory
- RHSA-2026:69232 vendor-advisory
- RHSA-2026:70264 vendor-advisory
- RHSA-2026:70584 vendor-advisory
- RHSA-2026:70803 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-18649 vdb-entry
- RHBZ#2510614 issue-tracking
- https://github.com/0xSemizzz/CVE-2026-18649
- https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/113