CVE-2026-18649

Name	CVE-2026-18649
Description	A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacker can send a continuous stream of RTP fragments without ever transmitting an end-of-fragment marker, causing the reassembly buffer to grow without bound until process memory is exhausted. This results in a denial of service through process termination.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
gst-plugins-good1.0 (PTS)	bookworm	1.22.0-5+deb12u3	vulnerable
	bookworm (security)	1.22.0-5+deb12u2	vulnerable
	trixie (security), trixie	1.26.2-1+deb13u2	vulnerable
	forky, sid	1.28.7-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
gst-plugins-good1.0	source	(unstable)	1.28.6-1

Notes

https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12234
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12244
Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/5cd490c125e04676659593b0f5b19130fc2face7 (1.28.6)
Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/820bd15585b13af8be9b0131699655194ae68a5b (1.28.6)
https://gstreamer.freedesktop.org/security/sa-2026-0076.html