CVE-2026-121625: GNU Gatekeeper before 5.16 Out-of-Bounds Read via RTCP SDES Parsing

Published Nov 3, 2026

Updated

GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in ParseRTCP() in ProxyChannel.cxx that allows remote RTP peers to read heap memory past received packets. Attackers can send RTCP SDES items lacking a NUL byte to the media proxy port during proxied H.323 calls with EnableRTCPStats enabled, crashing the gatekeeper.

Event History

Nov 3, 2026

CVE Published

via MITRE·05:13 PM

Data Sourced

via MITRE·05:13 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments running GNU Gatekeeper before 5.16 are exposed when they use proxied H.323 calls with EnableRTCPStats enabled. The vulnerable parsing occurs on the media proxy port.

What does an attacker need to exploit it?

An unauthenticated remote RTP peer must be able to send RTCP traffic to the media proxy port during a proxied H.323 call. Exploitation requires a specially formed RTCP SDES item that lacks a NUL byte.

What is the practical impact?

The out-of-bounds read can read heap memory beyond the received packet and can crash the gatekeeper, causing a denial of service. The provided information does not indicate confidentiality or integrity impact.

How can I mitigate the issue if upgrading is not immediately possible?

Disable EnableRTCPStats where operationally feasible, or prevent untrusted RTP peers from sending RTCP traffic to the media proxy port. These measures target the conditions required for the vulnerable RTCP SDES parsing path.

CVE-2026-121625: GNU Gatekeeper before 5.16 Out-of-Bounds Read via RTCP SDES Parsing

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the practical impact?

How can I mitigate the issue if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the practical impact?

How can I mitigate the issue if upgrading is not immediately possible?