CVE-2026-121626: GNU Gatekeeper before 5.16 Out-of-Bounds Read in H.460.24 RTCP Probe Handler
GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in H46024Socket::ReceivedProbePacket() that allows remote attackers to cause a heap over-read by sending short probe packets. Attackers can send a short application-defined RTCP packet to the media port during H.460.24 probing to read past the heap allocation and possibly crash the gatekeeper.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
GNU Gatekeeper versions before 5.16 are affected when H.460.24 probing is in use and the attacker can reach the media port handling the probe traffic.
What must an attacker do to trigger the flaw?
An unauthenticated remote attacker must send a short application-defined RTCP probe packet to the media port during H.460.24 probing. Exploitation requires high attack complexity, but no privileges or user interaction.
What is the likely operational impact?
The malformed packet causes a heap over-read and may crash the gatekeeper, resulting in an availability impact. The provided data does not indicate confidentiality or integrity impact.
How can the issue be remediated?
Upgrade GNU Gatekeeper to version 5.16 or later. If an immediate upgrade is not possible, restrict untrusted network access to the relevant media port to reduce exposure to crafted probe packets.